HOMETHREATSAbraham's Ax
APT / THREAT GROUP

Abraham's Ax

2
aliases

Intelligence Profile

Abraham's Ax announced their existence and mission through social media channels such as Twitter posts on November 8, 2022.

Abraham's Ax use a WordPress blog as the basis for their leak sites. Abraham's Ax site is available in Hebrew, Farsi, and English. The site also provides versions available via Tor websites, although it appeared to be under construction at the time of analysis. Used domain is registered with EgenSajt.se

Threat Analysis

Abraham's Ax is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.secureworks.com/blog/abrahams-ax-likely-linked-to-moses-staff
→https://www.ransomlook.io/group/abrahams_ax
→https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/abrahams-ax

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Abrahams_AxAbraham's Ax

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Abraham's Ax
Abraham's Ax — APT / Threat Group | Threat Intelligence | CTIWATCH.COM