BlackTech

BlackTech is a China-linked cyberespionage group targeting East Asia, particularly Taiwan, with additional activity in Japan and Hong Kong. Also known as Canary Typhoon, Circuit Panda, Palmerworm, T-APT-03, and 黑凤梨, it steals technology, confidential documents, and other sensitive information from government agencies and private organizations. Its targets include government contractors and organizations in the consumer electronics, computer, healthcare, and financial sectors. BlackTech is associated with the PLEAD, Shrouded Crossbow, and Waterbear campaigns, which share infrastructure, overlapping infections, and operational techniques. Its tooling includes the PLEAD remote-access backdoor, DRIGO document-exfiltration tool, BIFROSE, KIVARS, XBOW, and Waterbear. These tools provide remote command execution, system enumeration, credential harvesting, keylogging, file transfer, and document theft. DRIGO exfiltrates documents through Google Drive, while Waterbear uses modular backdoors loaded into memory and legitimate server applications modified to act as loaders. Initial access methods include spearphishing with malicious Office documents, disguised executable attachments, and links to cloud-hosted payloads. The group uses topical lures, decoy documents, right-to-left override filename manipulation, and stolen documents to support subsequent targeting. It has exploited Office and Flash vulnerabilities, including CVE-2018-0802 and CVE-2015-5119, and compromised IIS servers through CVE-2017-7269 to establish delivery and command-and-control infrastructure. Operators also scan for vulnerable routers and repurpose their VPN capabilities. Evasion techniques include encrypted in-memory payloads, changing malware wrappers, process injection, Tor-based communications, and living-off-the-land activity, including NetCat shells and enabling Remote Desktop Protocol through registry modifications.