Blackwood

Executive Summary

Blackwood is a China-aligned advanced persistent threat (APT) group active since 2018, specializing in cyberespionage against targets in China, Japan, and the UK. They use sophisticated adversary-in-the-middle attacks to deliver custom implants like NSPX30 through compromised software updates, while employing traffic interception to obscure command-and-control infrastructure locations.

Goals & Targeting

Blackwood's strategic objectives align with China's broader cyberespionage interests, focusing on intellectual property theft, state secrets acquisition, and disruption of adversarial nations' technological and defense sectors. Their targeting of China, Japan, and the UK reflects a focus on regions with advanced research capabilities and strategic geopolitical significance. Typical victims include technology firms, academic institutions, and government agencies involved in cybersecurity, telecommunications, and defense-related research.

Blackwood operates as a state-sponsored APT group with a focus on cyberespionage, targeting government entities, technology firms, and research institutions within China, Japan, and the United Kingdom. Their operations leverage sophisticated techniques, including adversary-in-the-middle (MITM) attacks to inject malicious payloads into legitimate software update channels, enabling stealthy deployment of their custom implants. A key component of their operations is the NSPX30 implant, which establishes covert communication channels while avoiding detection through obfuscation of command-and-control (C2) infrastructure locations. By intercepting traffic generated by the implant, Blackwood can dynamically route C2 communications through compromised networks, making attribution and tracking significantly more challenging. These capabilities suggest a high level of technical sophistication and long-term persistence in targeted environments.

Key Capabilities

• Adversary-in-the-middle (MITM) attacks for payload delivery
• Custom implant deployment (NSPX30)
• C2 infrastructure obfuscation via traffic interception
• Exploitation of software update mechanisms for persistent access

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Blackwood's campaigns, active since at least 2018, demonstrate a focus on long-term reconnaissance and data exfiltration. Their operational tempo includes periodic updates to TTPs, with a preference for leveraging trusted software channels to avoid detection. Notable operations involve compromising enterprise software update servers to distribute NSPX30, followed by sustained access to extract sensitive information from victim networks.

IOC Patterns

• Software update package tampering with embedded NSPX30 payloads
• C2 traffic routed through intercepted implant-generated DNS queries
• Anomalous network traffic patterns from compromised endpoints during off-hours

Recommended Actions

• Implement strict software update verification processes using cryptographic signatures
• Monitor DNS query patterns for irregularities in endpoint communication
• Deploy network traffic analysis tools to detect C2 obfuscation techniques
• Conduct regular red team exercises to identify MITM attack vulnerabilities
• Segment sensitive networks to limit lateral movement post-compromise

Suggested Tags