group

BlackOasis G0063

Created: 18 April 2018
Last modified: 31 July 2026
Alias: BlackOasis

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. [1] [2] A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified. [3]

TechniqueBottom 5%

TacticBottom 6%

Tools & malwareNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2021-09-16	21e4b3c1-4985-4aa4-a6c0-f8639590a5f3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-17	b222df08-0e07-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	73e67340-0d25-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	a136cde0-61ad-4a61-9b82-8dc490e60dd2
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-27	4edf51e1-cb83-4e1a-bc39-800e396068e3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2023-02-20	f7385ee2-0e0c-11eb-adc1-0242ac120002
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-12-29	7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2023-03-04	c70731dd-0097-40ff-b112-f7032f29c16c
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	20e5497e-331c-4cd5-8d36-935f6e2a9a07
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7a922f1b-2635-4d6c-91ef-af228b198ad3
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	175997c5-803c-4b08-8bb0-70b099f47595
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2026-03-16	4bf943c6-5146-4273-98dd-e958fd1e3abf
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-07-07	e75c48bd-3434-4d61-94b7-ddfaa2c08487
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	1b9dc62e-6e9e-42a3-8990-94d7a10007f7
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	2f211361-7dce-442d-b78a-c04039677378
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	fd0f5778-d3cb-4c9a-9695-66759d04702a
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog System	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	51aa9387-1c53-4153-91cc-d73c59ae1ca9
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-03-08	03b024c6-aad1-4da5-9f60-e9e8c00fa64c
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	a23791fe-8846-485a-b16b-ca691e1b03d4
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	11b52f18-aaec-4d60-9143-5dd8cc4706b9
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-15	6c96fc76-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2021-09-17	de7fb680-6efa-4bf3-af2c-14b6d33c8e6e
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	779c8c12-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	9ac8b09b-45de-4a07-9da1-0de8c09304a3
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	0c718a5e-4284-4fb9-b4d9-b9a50b3a1974
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	72862bf2-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of Environment Variables to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-15	27aec9c9-dbb0-4939-8422-1742242471d0
	Detects Obfuscated use of Environment Variables to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2021-09-17	3e27b010-2cf2-4577-8ef0-3ea44aaea0dc
	Detects Obfuscated use of Environment Variables to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	0adfbc14-0ed1-11eb-adc1-0242ac120002
	Detects Obfuscated use of Environment Variables to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e
	Detects Obfuscated use of Environment Variables to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	dcf2db1f-f091-425b-a821-c05875b8925a
	Detects Obfuscated use of Environment Variables to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	8ca7004b-e620-4ecb-870e-86129b5b8e75
	Detects Obfuscated Powershell via VAR++ LAUNCHER	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Timur Zinniatullin, oscd.community	2020-10-13	2021-09-18	7b9a650e-6788-4fdf-888d-ec7c0a62810d
	Detects Obfuscated Powershell via VAR++ LAUNCHER	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Timur Zinniatullin, oscd.community	2020-10-13	2022-11-16	e9f55347-2928-4c06-88e5-1a7f8169942e
	Detects Obfuscated Powershell via VAR++ LAUNCHER	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Timur Zinniatullin, oscd.community	2020-10-13	2024-04-05	e54f5149-6ba3-49cf-b153-070d24679126

Title

Description

BlackOasis G0063

BlackOasis G0063

BlackOasis MITRE reference G0063

Standing G0063

BlackOasis MITRE reference G0063

Standing G0063

Reach

Coverage

BlackOasis detections G0063