Gaby Portnoy, head of the Israel National Cyber Directorate (INCD), will expose the identities of hackers affiliated with the Iranian cyberattack group known as Black Shadow — operating on behalf of the Iranian Intelligence Ministry — as part of the Israeli technology conference Cybertech Global Tel Aviv.
The hacker group’s moniker has been reported on several times in Israel as responsible for a series of cyber-attacks against Israeli companies and targets and is also known by other aliases including Agrius and Malek Team.
The group operates undercover in offices located in Tehran. At first glance, the hacker’s front as a technology company located in a bustling business district appears like any typical high-tech company. However, the workers aren’t engaged in support services, computing, or IT, but rather in planned and systemic cyberattack operations against Israeli organizations.
According to information presented by Portnoy, a company established in 2013 that allegedly operates in the IT support and software development field serves as the hacker group’s front. The company’s employees, both men and women, engage in launching cyberattacks on organizations in Israel on behalf of the Iranian Intelligence Ministry and operate under pseudonyms. Their activities resemble those of several other state-sponsored hacker groups around the world. In Russia, China, or North Korea, it is common to conceal cyberattack activities against countries or enemies under the guise of commercial activity, often in the technology sector.
Against the backdrop of the war in Gaza, the hacker group attempted to attack a wide range of sectors in Israel, including organizations in academia, tourism, media, finance, transportation, health, government, and technology. The scope of the group’s activity increased during the war, alongside those of other hacker groups from Iran and other countries including Russia, Lebanon, Syria, Indonesia, Pakistan, and Bangladesh. Despite efforts to cause damage, the group’s recent ability to significantly impact Israel’s economy has been diminished. The group operates in cooperation with Iran-backed Hezbollah’s own cyberattack group, known as Lebanese Cedar.
The Black Shadow group has been very active in attacking Israel. It stood behind the attacks on Israeli company CyberServe three years ago and was responsible for publicly exposing the personal details of thousands of LGBT community members.
