Loading story…
China-linked espionage group BlackTech—also tracked as Earth Hundun, Palmerworm, and Red Djinn—was tied to sustained intrusions across East Asia, with a heavy focus on Taiwan and Japan and victims spanning government, media, telecommunications, defense, academia, technology, semiconductors, manufacturing, and professional services. Reporting describes spearphishing campaigns using password-protected archives and malicious Excel macro files, alongside exploitation of internet-facing systems including ProxyLogon, CVE-2015-5119, and CVE-2017-7269, to gain initial access. In Japanese campaigns, researchers linked tools including Flagpro, BTSDoor, LAMICE, BUSYICE, TELESWORD, DELTABEEF, SELFMAKE, and SPIDERPIG to the actor, while earlier operations used PLEAD, DRIGO, Waterbear, and Shrouded Crossbow malware built around BIFROST/BIFROSE, KIVARS, and XBOW variants.
Researchers said BlackTech used modular, multi-stage malware to steal credentials, profile hosts, maintain persistence, and exfiltrate sensitive documents, including government, defense, budget, and foreign-affairs material. Flagpro was described as an early-stage downloader and credential stealer that could fetch second-stage payloads such as BTSDoor, while Waterbear operated as an in-memory backdoor and DRIGO exfiltrated data through Google services; separate analysis also identified a Linux ELF Bifrose variant, showing the group’s tooling extends beyond Windows. Investigations further uncovered exposed directories and overlapping command-and-control infrastructure tied to BlackTech, including malware controllers and exploit collections for routers, Citrix, MikroTik, VMware vRealize, Cisco RV devices, Hongdian routers, and Oracle WebLogic, while domain-tracking research showed the actor repeatedly reused registrant details, name servers, and tech-themed domains even as registrar choices shifted over time.
TTPs, infrastructure, and targeting history in one profile.
21 events from the most recent confirmed update back to the earliest known activity.
A Cyber and Ramen post reported that recent BlackTech infrastructure activity appeared to shift away from historical GoDaddy and domaincontrol patterns toward registrars such as PDR Ltd. and Vitalwerks.
Cyber and Ramen published an analysis of a malicious Excel macro document and dropped dwm.exe payload assessed as likely linked to BlackTech, though not definitively identified as Flagpro. The report detailed screenshot-taking functionality and infrastructure including centos.onthewifi[.]com resolving to 103.195.150[.]181, with ties to previously reported BlackTech-style C2 behavior.
NTT Security Japan published an analysis of Flagpro describing its use in attacks on Japanese organizations in defense, media, and telecommunications and detailing its phishing-based delivery and capabilities.
PwC published its 'Back to Black(Tech)' report analyzing recent BlackTech operations, including spearphishing with malicious Excel files, Flagpro, BTSDoor, and an exposed tool directory.
PwC said tweets in July 2021 also showed the open directory tied to BlackTech infrastructure and tooling.
NTT Security Japan reported that in July 2021 researchers observed a new Microsoft Foundation Class-based Flagpro variant, which they called Flagpro v2.0.
PwC reported that an analyzed Flagpro sample associated with BlackTech had a compile timestamp of 2021-06-22 07:01:31.
PwC said it pivoted from the BlackTech-linked domain update.centosupdates.com to tweets showing an open directory in May and July 2021.
Trend Micro linked BUSYICE to Earth Hundun/BlackTech because BUSYICE and TSCookie shared command-and-control infrastructure in April 2021, including a cited domain and IP address.
Trend Micro reported that a second 2021-attributed Earth Hundun/BlackTech campaign had been active since at least March 2021, using ProxyLogon exploitation or malware-bundled installers.
NTT Security Japan said a sample posted to an online service in October 2020 indicates Flagpro may already have been used in attacks by that time.
Trend Micro reported that one 2021-attributed Earth Hundun/BlackTech campaign had been active since at least September 2020, targeting Japanese media, telecommunications, defense, academia, and some individuals.
PwC reported that BlackTech used similar malicious Excel macro documents in 2018 to drop the TSCookie malware.
Trend Micro assessed that BTSDOOR appears to have been developed since at least 2018 based on compilation time and PDB data.
Trend Micro reported that PLEAD briefly used a fileless malware variant leveraging the leaked Hacking Team Flash exploit for CVE-2015-5119 embedded in crafted documents.
Infrastructure analysis found a spike in BlackTech-linked domain registrations in 2013, which the author says was largely due to the 'Four-Element Sword Engagement.'
Trend Micro reported that the PLEAD information-theft campaign has been active since 2012, targeting Taiwanese government agencies and private organizations.
Analysis cited in the ELF Bifrose article states that a group likely identified as BlackTech probably obtained the Bifrose source code around 2010 and enhanced it for its own campaigns.
Trend Micro reported that the Shrouded Crossbow campaign was first observed in 2010 and used BIFROST-derived backdoors against government contractors and enterprises.
The Bifrose/Bifrost backdoor malware family was first identified in the early 2000s as malware targeting Windows systems.
The ELF Bifrose analysis said a recent Linux Bifrose sample was highlighted in a tweet by @strinsert1Na on November 24 before the article's publication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
cyberandramen.net
Open sourcecyberandramen.net
Open sourcecyberandramen.net
Open sourceinsight-jp.nttsecurity.com
Open sourcetrendmicro.com
Open sourcevblocalhost.com
Open sourcedocuments.trendmicro.com
Open sourcejsac.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied multiple malware families used by **BlackTech** to intrusions against organizations in Japan and elsewhere, showing the group operating across both Windows and Linux systems. JPCERT/CC reported that the **IconDown** downloader fetched data from attacker-controlled hosts, searched for a fixed 9-byte signature, extracted a 256-byte **RC4** key, decrypted embedded configuration data and a PE payload, then wrote the payload to disk and optionally launched it via `cmd.exe`. Related reporting from ESET said BlackTech also abused the **ASUS WebStorage** update mechanism in router-level man-in-the-middle attacks to distribute **PLEAD** malware, extending the group’s delivery options beyond direct malware staging.
Aug 15, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026