Skip to content
Install MCP

Threat actor

Black Cube

Last fetched

Black Cube is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Black Cube is a private intelligence agency based in Israel that provides intelligence and investigative services to a wide range of clients. The agency was founded by former Israeli intelligence officers, with offices in London and Madrid. Black Cube is known for conducting corporate espionage, intelligence gathering, and investigations on behalf of corporations, governments, and high-profile individuals worldwide. Its clients include Harvey Weinstein and Trump. It was banned by Meta for its surveillance activities on its platforms. Its international advisory board included Meir Dagan, former head of Mossad, and Yohanan Danino, former Israeli Police Commissioner, as well as Major General Giora Eiland, former head of the Israeli National Security Council, and who headed the IDF's Operation Branch. Former NSO CEO Shalev Hulio admitted to hiring Black Cube at in at least one situation in Cyprus.

Techniques by tactic

No ATT&CK techniques are recorded for Black Cube in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Black Cube today — this states the absence of a published link, not that Black Cube has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Black Cube into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.