Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · BlackTech · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

BlackTech

  • CIRCUIT PANDA
  • Temp.Overboard
  • HUAPI
  • Palmerworm
  • G0098
  • T-APT-03
  • Manga Taurus
  • Red Djinn

MITRE G0098 ↗

BlackTech — ATT&CK roseBL

attack rose · 14 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology. Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.

PLEAD is an information theft campaign with a penchant for confidential documents. Active since 2012, it has so far targeted Taiwanese government agencies and private organizations. PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.

PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services. Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO. PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server.

This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

14 techniques · 6 of 15 tactics

  1. Resource development

    3 techniques

  2. Initial access

    3 techniques

  3. Execution

    4 techniques

  4. Stealth

    2 techniques

  5. Discovery

    1 technique

  6. Lateral movement

    1 technique

select a technique

Arsenal

5 malware · 1 tools
Malware
Malware · 5ATT&CK
PLEADS0435 ↗
KivarsS0437 ↗
TSCookieS0436 ↗
FlagproS0696 ↗
WaterbearS0579 ↗
Tools
Tools · 1ATT&CK
PsExecS0029 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs BlackTech is cited as exploiting

none on KEV
  1. CVE-2015-51192026-10-17
    1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2017-01992026-10-17
    1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2012-01582026-10-17
    1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2014-63522026-10-17
    1. “BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2017-72692026-10-17
    1. “BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

15 sources
  1. 1.blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blackt…
  2. 2.welivesecurity.com/2018/07/09/certificates-stolen-taiwanese-tech-companie…
  3. 3.welivesecurity.com/2019/05/14/plead-malware-mitm-asus-webstorage
  4. 4.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  5. 5.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revea…
  6. 6.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espiona…
  7. 7.unit42.paloaltonetworks.com/atoms/mangataurus
  8. 8.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/c…
  9. 9.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-re…
  10. 10.trendmicro.com/en_us/research/24/d/earth-hundun-waterbear-deuterbear.…
  11. +5 more in the JSON record

Track BlackTech on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.