1 malware familyExploits CVEs in the wild

BlackOasis

Also known asBlackOasis

BlackOasis is a threat actor referenced in the provided content as using obfuscation and exploit-based intrusion tradecraft. The content states that BlackOasis used CVE-2017-0199 in the wild and was believed to be a customer of Gamma Group that utilized FinSpy. It also states that BlackOasis used first-stage shellcode containing a NOP sled with alternative instructions that was likely designed to bypass antivirus tools. Across the provided ATT&CK-annotated detection content, BlackOasis is associated with obfuscated files or information (T1027), including use of encoded PowerShell commands and Linux base64 decode activity passed to shell processes. The content places BlackOasis in Middle Eastern exploitation activity in 2017 alongside use of CVE-2017-0199. No additional aliases or sub-groups are provided beyond the name BlackOasis.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

6 of 15 tactics9 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1190

Exploit Public-Facing Application

TA0002

Execution

2 techniques

T1059

Command and Scripting Interpreter

T1059.004

Unix Shell

T1204

User Execution

TA0005

Stealth

2 techniques

T1027×11

Obfuscated Files or Information

T1497

Virtualization/Sandbox Evasion

TA0007

Discovery

1 technique

T1497

Virtualization/Sandbox Evasion

TA0008

Lateral Movement

1 technique

T1210

Exploitation of Remote Services

TA0011

Command and Control

1 technique

T1105

Ingress Tool Transfer

ARSENAL

Associated malware families

1 malware family attributed to this actor across reporting.

FamilyContextEvidenceLast seen

FinFisher"...utilizes the popular ‘lawful surveillance’ kit FinSpy."1Mar 18, 2026

WEAPONIZED

Associated vulnerabilities

4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.

CVE-2015-5119Adobe Flash Player ByteArray valueOf Use-After-Free RCEIn the wildEvidence1

We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.

CVE-2016-0984Use-After-Free in Adobe Flash Player and AIR (CVE-2016-0984)In the wildEvidence1

We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.

CVE-2016-4117Adobe Flash Player Remote Code Execution VulnerabilityIn the wildEvidence1

We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.

CVE-2017-0199Microsoft Office/WordPad Remote Code Execution VulnerabilityIn the wildEvidence1

we did produce two reports revolving around the use of a zero-day exploit (CVE-2017-0199). The most notable involved an actor we refer to as BlackOasis and their usage of the exploit in-the-wild prior to its discovery.

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

splunk researchNews

Feb 25, 2026

Detection: Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts | Splunk Security Content

Listed as an associated threat actor in the detection annotations for exploitation-related activity.

splunk researchNews

Feb 25, 2026

Detection: Linux Decode Base64 to Shell | Splunk Security Content

Listed as a threat actor associated with the Linux base64-to-shell execution detection analytic.

splunk researchNews

Feb 25, 2026

Detection: Linux Obfuscated Files or Information Base64 Decode | Splunk Security Content

Listed as a threat actor associated with the Obfuscated Files or Information (T1027) defense evasion technique, specifically relevant to base64 decoding on Linux.

splunk researchNews

Feb 9, 2026

Detection: Malicious PowerShell Process - Encoded Command | Splunk Security Content

Referenced as a threat actor associated with use of obfuscated PowerShell encoded commands for defense evasion.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping7

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs4

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.