BlackTech - G0098

Created: 2020-05-05T18:36:45.970Z

Modified: 2022-04-06T13:14:27.477Z

Contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.,Hannah Simes, BT Security

Aliases

BlackTech,Palmerworm

Description

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)

Techniques Used

BlackTech has obtained and used tools such as Putty, SNScan, and

PsExec for its operations.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

BlackTech has used valid, stolen digital certificates for some of their malware and tools.(Citation: ESET PLEAD Malware July 2018)|
|mitre-attack|enterprise-attack|PRE|T1588.003|Code Signing Certificates|

BlackTech has used stolen code-signing certificates for its malicious payloads.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

BlackTech has used the SNScan tool to find other potential targets on victim networks.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

BlackTech has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|