BlackTech

BlackTech is a cyber espionage group that US and Japanese government agencies link to China. It has been active for more than ten years. It mainly targets government, military and telecommunications firms, and it is known for compromising routers and other network devices instead of only endpoints. It is also tracked as Palmerworm, Circuit Panda and Temp.Overboard.

Introduction

BlackTech is a cyber espionage group that has operated with great skill for more than ten years. Its main edge is the mix of stealth and persistence. This lets it run espionage actions over a long period. It also focuses heavily on compromising network infrastructure, not just endpoints. Over the past decade it has mostly targeted government agencies, military organizations and telecommunications providers in East Asia and Southeast Asia. It now more and more targets Western nations as well.

BlackTech has also operated under many different names, including CIRCUIT PANDA, Canary Typhoon, Earth Hundun, G0098, HUAPI, Manga Taurus, Palmerworm, Red Djinn, T-APT-03 and Temp.Overboard. Each name marks a different point in the growth of BlackTech, or a different set of operations with similar goals. The many names show how hard it is to attribute modern threats in threat intelligence.

BlackTech is known under many names. Analysts strongly agree that these names all refer to the same state-sponsored espionage organization based in China. It has a common set of overall goals and tactics. In this blog, we discuss BlackTech’s identity, goals, and methods. We also cover how the group has evolved and what impact it has now.

Who is BlackTech and what motivates it?

There is a high degree of confidence that BlackTech’s espionage operation is state-sponsored and follows the key interests of the PRC. Its campaigns support intelligence collection in four areas: regional security threats, military modernization, international diplomatic positioning, and advancing China’s high technology.

Attribution: BlackTech can be categorized as an advanced persistent threat (APT) group aligned with China. It likely operates at the direction and request of Chinese intelligence departments or military cyber units.

Active Since: The group has been operating since at least the early 2010s, and active operations are expected to continue through 2025 and beyond.

Motivation: BlackTech is not driven by a need to make money from its operations. Its main goal is to collect intelligence over time. It also aims to set up surveillance of government and military assets and to keep access to standard telecommunications and network infrastructure. In addition, it helps the growth of China’s geopolitical ambitions in the region and globally.

The group’s interests and methods show a clear effort to avoid detection. It is a cyber intelligence gathering organization with a long-term focus. It is not built to run disruptive cyber operations.

What tactics does BlackTech use?

BlackTech has deep technical skills, and compromised networks are at the heart of its work. It can use a vast array of methods to gain access.

Initial Access

BlackTech takes many avenues to gain initial access. Some of these methods include:

• Spearphishing campaigns with themes relating to either government agencies or industries
• Exploiting vulnerabilities in services and devices that are accessible via the Internet
• Compromising trusted third-party service providers
• Using weak authentication or incorrectly configured remote management interfaces

BlackTech’s focus on devices at the network edge (i.e., routers/switches/firewalls) has allowed BlackTech to bypass endpoint protection measures.

Execution & Tooling

After gaining access, BlackTech uses custom-made malware and native systems tools to access their targets. Examples include:

• Backdoor malware such as Flagpro, PLEAD and TSCookie variants
• Modular loaders that allow payloads to be delivered to targeted systems on-the-fly
• The use of scripts and binary files customized to meet the needs of target firms.

Malware created by BlackTech tends to be lightweight and designed to mimic the activity of normal systems and networks.

Persistence

The BlackTech group has many means to enable persistent access to the network environment. Some of those methods include:

• Modifying firmware/system startup scripts of network devices
• Creating hidden administrative accounts
• Installing stealth backdoors within legitimate services
• Employing many redundant means to maintain access in the event of a remediation effort

By using these techniques, BlackTech is able to retain access to a compromised environment even after the environment has been partially cleaned up.

Command and Control (C2)

The C2 infrastructure operated by the BlackTech group was designed for stealth. BlackTech uses the following techniques to evade detection of its C2 infrastructure:

• All communications are encrypted through either HTTPS or custom-made protocols
• Compromised routers and servers are configured as C2 relay nodes
• The use of often rotating domains and IP addresses

BlackTech has also used the victim’s own network devices to act as covert C2 proxy.

Defense Evasion

BlackTech consistently uses methods to evade detection through the means of:

• Little or no use of noisy malware
• Reliance on legitimate, administrative functions
• Limited forensic evidence remaining on the hard drive
• Disabling or circumventing any form of logging activity on the compromised device

The above methods dramatically increase BlackTech’s ability to avoid detection and attribution.

Notable Operations

BlackTech has greatly affected global firms and government entities through espionage campaigns in several operations.

East Asian Government Intrusions

BlackTech has focused much of its efforts against government resources in East Asia, including targeting:

• Ministry of Defence
• Government Ministers
• Other public sector organizations

BlackTech has been especially successful at breaking into these firms and staying inside for months or years without detection.

Telecommunications and ISP Compromise

BlackTech is widely known for targeting companies that provide telephone and ISP services. By compromising routers and the overall network infrastructure, BlackTech has been able to get useful data such as:

• The ability to “see” a firm’s entire network traffic
• Access to its users’/customers’ Metadata
• Key partnerships with national telecommunications companies, by being able to manipulate their telecommunications infrastructure on purpose.

Such access yields large intelligence value. It could also be used in the event of geopolitical conflict.

Technology and Manufacturing Espionage

Also, BlackTech has targeted Technology and Manufacturing Companies involved in the following technical areas:

• Semiconductor manufacturing and technology
• Networking hardware technology
• Advanced Electronic Technology

The data collected through the methods above shows China’s efforts to build domestic innovation and reduce dependency on external technology.

Use of Compromised Infrastructure as Attack Platforms

On at least a couple of occasions, BlackTech has used compromised routers and servers from a variety of firms as staging points for further attacks. This lets it move laterally to more target firms and hide the first point of attack.

What has BlackTech done recently?

BlackTech is one of many advanced persistent Chinese cyber threat groups that compromised telecommunications infrastructure worldwide. It has recently improved both its plans and its surveillance tools.

Infrastructure-Centric Focus: BlackTech has taken a more infrastructure-centric approach. It has greatly increased its focus on other attack vectors, including compromising edge devices, VPNs and routers. These devices are typically among the least monitored in a firm. They therefore present inherent risk to a firm’s data.

Improved Operational Security: BlackTech has also shown better operational security (OPSEC). It compartmentalizes operations better and rotates its supporting infrastructure more quickly. It also reuses far fewer malware artifacts in attacks on target firms.

Overlap with Other China-Aligned Clusters: Analysts have noted some overlap between BlackTech and other PRC-associated threat actors. Some suggest that this points to a larger ecosystem of attackers that share resources or split tasks among one another.

Expanded Geographic Scope: BlackTech’s main theater of operations is East Asia. It is increasing its focus on Europe and North America, with a particular interest in the telecommunications and technology sectors.

Strategic Impact

As a key threat to both U.S. and allied interests, BlackTech presents a number of national security risks:

National Security Risk: Compromising government and/or military networks causes a loss of confidentiality. It will also limit their long-term strategic planning features.

Telecommunications Exposure: Access to telecom infrastructure opens the door to systemic vulnerabilities (surveillance, future disruption) at scale. This is a unique systemic risk.

Economic and Technological Edge: Stealing sensitive technology data gives China an economic and technological edge. It helps China reach its long-term industrial and military goals.

Attribution and Detection Challenges: The unique and advanced nature of BlackTech’s approach is a major threat to the network defense and detection features of firms.

Conclusion

BlackTech is one of the most skilled and capable of the APT groups loyal to China, and it still operates today as a strong APT (advanced persistent threat) group. It has reached long-term intelligence goals by focusing on compromising infrastructure and running persistent operations. It also keeps highly disciplined operational security to avoid detection.

Companies are adopting edge-computing tools and relying more on cloud-connected infrastructure. As they modernize their networks, many miss the blind spot that BlackTech’s operations exploit. To protect against these threats, companies need traditional endpoint security measures plus three more features:

1. Full visibility into all network-connected devices
2. Rapid scanning and mitigation of discovered vulnerabilities
3. Intelligence-driven threat “hunting” to find and counteract these campaigns

Given the current global climate and BlackTech’s flexibility, this APT group will likely be a key player in China’s cyber espionage programs for many years beyond 2025.

You can download and review the sheet for all the details!