Loading story…
Researchers tied multiple malware families used by BlackTech to intrusions against organizations in Japan and elsewhere, showing the group operating across both Windows and Linux systems. JPCERT/CC reported that the IconDown downloader fetched data from attacker-controlled hosts, searched for a fixed 9-byte signature, extracted a 256-byte RC4 key, decrypted embedded configuration data and a PE payload, then wrote the payload to disk and optionally launched it via cmd.exe. Related reporting from ESET said BlackTech also abused the ASUS WebStorage update mechanism in router-level man-in-the-middle attacks to distribute PLEAD malware, extending the group’s delivery options beyond direct malware staging.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Cyber and Ramen analyzed an updated ELF_PLEAD backdoor sample, describing a dynamically linked 64-bit Linux executable that used SSL, supported file operations, remote shell, and proxying, and contained hardcoded C2 IP 168.95.1.1. The post also contrasted the sample with earlier public reporting and published the sample hash as an IOC.
JPCERT/CC published analysis of ELF_PLEAD, a Linux malware family used by BlackTech, and described its similarities to the Windows PLEAD module. The report detailed its RC4-encrypted configuration, custom C2 protocol, and command groups for file management, transfer, remote shell, port forwarding, and malware control.
Cyber and Ramen says TeamT5 reported in April 2020 on an intrusion at a Taiwan academic institution attributed to BlackTech. The intrusion reportedly used Ghostcat (CVE-2020-1938) for initial access and involved a Unix variant of the Bifrose/Bifrost backdoor.
Cyber and Ramen states that JPCERT identified a Linux variant of BlackTech's TSCookie loader in March 2020. This marked public reporting of BlackTech Linux-focused tooling beyond its Windows malware families.
JPCERT/CC published an analysis of IconDown, confirming BlackTech used the downloader in attacks against Japanese organizations. The report detailed how IconDown retrieved a file, extracted an RC4 key and payload, and could write and execute the resulting PE file, while also publishing sample hashes and C2-related indicators.
ESET published reporting that PLEAD malware was distributed through man-in-the-middle attacks abusing the ASUS WebStorage update function. Later JPCERT/CC reporting cited this distribution method in related BlackTech activity.
JPCERT/CC reported that in May 2019, TSCookie samples used in attacks had been modified to correct the configuration copy size from 0x8D4 to 0x1000, fixing a previously documented decoding bug. The update also resolved a problem that prevented the malware from reconnecting to its command-and-control server for several days, and JPCERT/CC published sample hashes and associated C2 servers.
JPCERT/CC said an updated version of the TSCookie malware, believed to be used by BlackTech, was observed in attacks around August 2018. The update changed C2 communications from the HTTP Cookie header to encrypted URL parameters and introduced a configuration-reading bug.
Cyber and Ramen says Intezer tweeted in late March 2021 a hash for what was described as a fully undetectable version of ELF_PLEAD. This indicated continued evolution of BlackTech's Linux backdoor tooling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
cyberandramen.net
Open sourceblogs.jpcert.or.jp
Open sourceblogs.jpcert.or.jp
Open sourceblogs.jpcert.or.jp
Open sourcewelivesecurity.com
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked espionage group **BlackTech**—also tracked as **Earth Hundun**, **Palmerworm**, and **Red Djinn**—was tied to sustained intrusions across East Asia, with a heavy focus on Taiwan and Japan and victims spanning government, media, telecommunications, defense, academia, technology, semiconductors, manufacturing, and professional services. Reporting describes spearphishing campaigns using password-protected archives and malicious Excel macro files, alongside exploitation of internet-facing systems including **ProxyLogon**, `CVE-2015-5119`, and `CVE-2017-7269`, to gain initial access. In Japanese campaigns, researchers linked tools including **Flagpro**, **BTSDoor**, **LAMICE**, **BUSYICE**, **TELESWORD**, **DELTABEEF**, **SELFMAKE**, and **SPIDERPIG** to the actor, while earlier operations used **PLEAD**, **DRIGO**, **Waterbear**, and **Shrouded Crossbow** malware built around **BIFROST/BIFROSE**, **KIVARS**, and **XBOW** variants. Researchers said BlackTech used modular, multi-stage malware to steal credentials, profile hosts, maintain persistence, and exfiltrate sensitive documents, including government, defense, budget, and foreign-affairs material. **Flagpro** was described as an early-stage downloader and credential stealer that could fetch second-stage payloads such as **BTSDoor**, while **Waterbear** operated as an in-memory backdoor and **DRIGO** exfiltrated data through Google services; separate analysis also identified a Linux **ELF Bifrose** variant, showing the group’s tooling extends beyond Windows. Investigations further uncovered exposed directories and overlapping command-and-control infrastructure tied to BlackTech, including malware controllers and exploit collections for routers, Citrix, MikroTik, VMware vRealize, Cisco RV devices, Hongdian routers, and Oracle WebLogic, while domain-tracking research showed the actor repeatedly reused registrant details, name servers, and tech-themed domains even as registrar choices shifted over time.
Aug 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026