Blackshadow
Blackshadow is an Iran-attributed ransomware group with an ideological motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 14 countries, including the United States and India. It uses 60 MITRE ATT&CK techniques and exploits 7 known CVEs.
- Pink Sandstorm
- AMERICIUM
- Agonizing Serpens
- DEV-0227
- SharpBoys
- Spectral Kitten
- Origin
- Iran
- Techniques
- 60
- Exploited CVEs
- 7
- First seen
- Jan 1, 2020
- Last seen
- Nov 6, 2023
- Record updated
Who They Target.
About Blackshadow.
BlackShadow is an Iranian-linked hack-and-leak group (linked to the Agrius APT) that targeted Israeli companies including insurance firm Shirbit and hosting provider Cyberserve, leaking medical records of 290,000 patients, using extortion as a tool of geopolitical disruption rather than purely for financial gain.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.