Black Axe

☆ pin

Reports

First seen

Feb 2, 2026

Last seen

Sep 17, 2026

Motivation

Financial

Targeting

Sectors

Other ×2

Victim regions

×2

United States×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×4T1041 Exfiltration Over C2 Channel ×2T1190 Exploit Public-Facing Application ×2T1486 Data Encrypted for Impact ×2T1110 Brute Force ×1T1218 System Binary Proxy Execution ×1T1566.002 Phishing: Spearphishing Link ×1T1203 Exploitation for Client Execution ×1T1498 Network Denial of Service ×1T1195 Supply Chain Compromise ×1T1040 Network Sniffing ×1T1204 User Execution ×1

Indicators

cve ×9domain ×3filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-53690 (exploited)CVE-2025-64155 CVE-2025-8088 (exploited)CVE-2026-1281 (exploited)CVE-2026-20045 (exploited)CVE-2026-20079 (exploited)CVE-2026-20316 (exploited)CVE-2026-21509 (exploited)CVE-2026-59310 (exploited)

Recent reports

High

Black Axe

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Five Black Axe cybercriminal members extradited from South Africa to face US fraud charges

Five Black Axe leaders extradited from South Africa to US for romance and advance-fee scams

58 arrested in international cybercrime crackdown across 22 countries

Interpol disrupts Black Axe and affiliated organized crime networks in Operation Jackal IV

CERT-EU Cyber Brief January 2026 – Espionage, Ransomware, and Critical Vulnerabilities