BlackTech

Executive Summary

BlackTech is a suspected Chinese cyber espionage group targeting organizations in East Asia and the U.S., particularly sectors like technology and finance, using custom malware and living-off-the-land tactics.

Goals & Targeting

BlackTech's primary motivation is espionage, targeting sectors with sensitive technological and strategic information. They focus on East Asian countries and the U.S., likely due to geopolitical interests and access to advanced technologies in targeted industries.

BlackTech, also known as Palmerworm, Temp.Overboard, and other aliases, has been active since at least 2013. Primarily targeting Taiwan, Japan, Hong Kong, and the U.S., this threat actor focuses on industries such as electronics, engineering, construction, and finance. They employ a mix of custom malware, dual-use tools, and living-off-the-land techniques to breach victim networks. Their activities include campaigns like Shrouded Crossbow and Waterbear, leveraging sophisticated tactics to achieve their espionage goals.

Key Capabilities

• Custom malware
• Dual-use tools
• Living off the land tactics
• Exploitation frameworks
• Spearphishing

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

BlackTech is known for prolonged campaigns targeting critical sectors. Their operational tempo includes methodical attacks with tools like PLEAD and Waterbear, often exploiting network services and using malicious files to compromise systems.

IOC Patterns

• Spear-phishing with malicious attachments
• Use of custom malware and dual-use tools
• Exploitation for client execution via known techniques

Recommended Actions

• Monitor MITRE ATT&CK techniques linked to BlackTech.
• Implement multi-factor authentication.
• Segment sensitive network areas.
• Regularly update software against known vulnerabilities.
• Train employees on phishing detection.

Suggested Tags