BlackTech
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.
- ATT&CK ID
- G0098
- Origin
- China
- Techniques
- 10
- Tools
- 6
Also tracked as Palmerworm
Vulnerabilities it has exploited
- CVE-2012-0158 Microsoft MSCOMCTL.OCXUnscored · exploited in the wild
- CVE-2014-6352 Microsoft WindowsUnscored · exploited in the wild
- CVE-2015-5119 Adobe Flash PlayerUnscored · exploited in the wild
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2017-7269 Microsoft Internet Information Services (IIS)Unscored · exploited in the wild
Techniques
Resource Development
Initial Access
Exploit Public-Facing ApplicationPhishing
Execution
Native APIExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Stealth
MasqueradingHijack Execution Flow
Discovery
Lateral Movement
Software
Flagpro · Kivars · PLEAD · PsExec · TSCookie · Waterbear