Black Phoenix provides active cyber defense, threat intelligence and incident response for organizations operating in high-risk or sensitive environments.
We investigate threats, understand adversary activity and protect the systems, communications and infrastructure that matter most.
From active response to long-term defense, our work is built around the specific threat, environment and objective.
Contain, investigate and remediate active compromises, intrusions and other cyber incidents.
Track threat actors, infrastructure, campaigns and indicators relevant to the client and its operating environment.
Assess and harden networks, systems and exposed infrastructure against intrusion, exploitation and unauthorized access.
Identify weaknesses through controlled testing, attack-path analysis and security assessments.
Establish what happened, how access was obtained, what was affected and what evidence remains.
Connect cyber activity with physical threats, personnel, locations and operational environments where the two overlap.
Cyber incidents rarely exist in isolation. A compromised account, exposed system or suspicious connection may be part of a larger operation.
Our cyber work can combine technical investigation with threat intelligence, open-source research and our wider intelligence capabilities to understand both the digital activity and the people, infrastructure and objectives behind it.
Cyber defense where digital exposure carries serious operational, financial, or security consequences.
Protection, incident response, threat intelligence and investigations for organizations where digital compromise can create significant operational or financial exposure.
Cyber defense for energy, telecommunications, transport, utilities and other essential systems.
Protection of sensitive networks, systems and digital infrastructure supporting defense and military operations.
Security and intelligence support for sensitive public-sector systems and operations.
Protection and investigation for individuals whose digital exposure, communications or assets require a higher level of security.
A focused process from initial assessment through response, hardening and ongoing protection.
Understand the environment, exposure and immediate concerns.
Establish vulnerabilities, indicators, threat activity and relevant adversary infrastructure.
Contain active threats and take appropriate defensive action.
Address weaknesses and improve resilience against further compromise.
Continue intelligence and defensive activity where ongoing protection is required.
Selected engagements demonstrating how we approach cyber incidents, investigations and defensive operations. Client identities and operational details are withheld where necessary.
Uncovered a joint cyber attack operation between Kataeb el Hezbollah's cyber team (Fatimiyoun) in Iraq and Hezbollah's cyber division targeting key Lebanese anti-IRGC/Hezbollah institutions, including the Presidential Palace, Ministries, and media outlets.
Uncovered a complex, multi-year Israeli cyber espionage operation gathering sensitive personal records and blackmailing material targeting a specific Lebanese sect.
Mapped and confirmed 3 main physical bases utilized by Hezbollah's cyber team in Lebanon.
Tell us what you are trying to protect, investigate or understand. We will assess the environment and determine the appropriate defensive and intelligence approach.