Log in Request a demo

Threat group profile

BlackTech threat group profile

Also known as Palmerworm, Temp.Overboard, Circuit Panda

Attributed by the US and Japanese governments (joint advisory, 27 September 2023) to cyber actors linked to the People's Republic of China, BlackTech is described as targeting government, technology, media, electronics and telecommunication organizations in East Asia and the US.

In short

Attributed by the US and Japanese governments (joint advisory, 27 September 2023) to cyber actors linked to the People's Republic of China, BlackTech is described as targeting government, technology, media, electronics and telecommunication organizations in East Asia and the US. It steals information, and the advisory details how it hides in router firmware to keep access.

Last updated 10 October 2026

Profile MapThreat Group
  1. Attributed OriginChina
  2. Names5names in public reportsBlackTech · Palmerworm · Temp.Overboard
  3. Sectors10named as targetsJapan · Taiwan · Hong Kong
  4. Techniques14in the attack chainInitial Access · Execution · Resource Development
  5. Tools11tools and malware listedFlagpro · PLEAD · TSCookie

In one minute

Who they are
The US and Japanese governments (CISA, NSA, FBI, Japan NPA and NISC, 27 September 2023) attribute BlackTech to PRC-linked cyber actors. CISA says it has been active since 2010. MITRE says since at least 2013.
Who they target
Government, industrial, technology, media, electronics and telecommunication organizations in Japan, the US, Taiwan and Hong Kong, including entities that support the US and Japanese militaries, as CISA and MITRE describe.
How they usually get in
Spearphishing, exploited flaws in internet-facing systems, and the trusted link between branch routers and headquarters. CISA says it modifies router firmware to hide.
What stands out
CISA says it can modify router firmware without detection and uses subsidiary routers to pivot to headquarters in Japan and the US.
What to do first
Review branch and subsidiary router connections, patch internet-facing systems, limit router admin access and monitor router firmware and reboots.

Names

Public reports use several names for this activity.

Names used for BlackTech threat group profile
NameWhere it appears
BlackTech MITRE ATT&CK G0098 (group name) and the joint advisory AA23-270A[1, 2]
Palmerworm MITRE ATT&CK Associated Groups and the joint advisory AA23-270A[1, 2]
Temp.Overboard Joint advisory AA23-270A[2]
Circuit Panda Joint advisory AA23-270A[2]
Radio Panda Joint advisory AA23-270A[2]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • CISA, NSA, FBI, Japan NPA and Japan NISC 27 September 2023

    Joint advisory AA23-270A detailed the activity of the PRC-linked cyber actors known as BlackTech, and named Japan and the US as the primary targets.[2]

  • CISA 27 September 2023

    Press release on the advisory: BlackTech activity targets government, industrial, technology, media, electronics, telecommunication and defense industrial base sectors.[3]

  • CISA 27 September 2023

    Alert on the advisory: BlackTech pivots from international subsidiaries to headquarters in Japan and the US, which are the primary targets.[4]

  • CISA 27 September 2023

    Tags the advisory with the nation-state actor China.[2]

  • Japan National Police Agency and NISC 27 September 2023

    Joint press release warning about BlackTech, a cyber attack group backed by China (its wording), issued with NSA, FBI and CISA.[5]

  • MITRE ATT&CK 31 July 2026

    Describes BlackTech as a suspected Chinese cyber espionage group. Page last modified 31 July 2026.[1]

  • JPCERT/CC 15 September 2022

    Said it considers the 2022 F5 BIG-IP attacks on Japanese organizations to be related to BlackTech activities. This statement is about the group, not a state.[7]

Where sources differ

Sources differ on the start date. CISA and the Japan NPA say BlackTech has been active since 2010 (the NPA says around 2010). MITRE says since at least 2013, but it also says the Kivars tool was used in a 2010 campaign. Sources also differ in strength: CISA, NSA, FBI, NPA and NISC call the actors PRC-linked, while MITRE says BlackTech is a suspected Chinese group. MITRE says TSCookie and PLEAD are likely separate tools, while CISA lists FakeDead as another name for TSCookie.

Who they target

Sectors

  • JapanMITRE names Japan among the main target countries. CISA names Japan, with the US, as the primary targets for the router-based pivoting. The Japan NPA says targets include Japan.[1, 2, 5]
  • TaiwanMITRE says BlackTech has targeted organizations in East Asia, particularly Taiwan, Japan and Hong Kong.[1]
  • Hong KongMITRE lists Hong Kong with Taiwan and Japan as East Asian targets.[1]
  • United StatesMITRE and CISA name the US as a target. CISA says US and East Asia public organizations and private industries.[1, 2]
  • GovernmentCISA says BlackTech has targeted government, industrial, technology, media, electronics and telecommunication sectors.[2, 5]
  • Defense and military supportCISA says targets include entities that support the militaries of the US and Japan. CISA's press release adds the defense industrial base.[2, 3]
  • Media, construction, engineering, electronics, financeMITRE says BlackTech compromised media, construction, engineering, electronics and financial company networks.[1]
  • Defense, media and communications in JapanMITRE says the Flagpro downloader has mainly been used against defense, media and communications companies in Japan.[11]
  • Multinational companies with subsidiariesCISA says BlackTech targets international subsidiaries of US and Japanese companies, then pivots to headquarters.[2]
  • Organizations running F5 BIG-IPJPCERT/CC confirmed attacks around May 2022 on Japanese organizations through an F5 BIG-IP flaw.[7]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2010

    Kivars used

    MITRE says the Kivars remote access tool was used by BlackTech in a 2010 campaign. CISA and the Japan NPA say the group has been active since about 2010.[15, 2, 5]

  2. At least 2013

    MITRE start date

    MITRE says BlackTech has targeted East Asia and the US since at least 2013. Sources differ on the start.[1]

  3. March 2017

    PLEAD seen

    MITRE says PLEAD was observed in use as early as March 2017.[12]

  4. 2018

    Attacks on Japan

    JPCERT/CC says BlackTech has been actively conducting attacks against Japanese organizations since 2018.[8]

  5. 8 June 2018

    PLEAD article

    JPCERT/CC published an article on the PLEAD downloader used by BlackTech.[6]

  6. 21 November 2019

    IconDown article

    JPCERT/CC published an article on IconDown, a downloader it confirmed BlackTech uses.[6, 10]

  7. 5 March 2020

    Linux version of TSCookie

    JPCERT/CC published an article on a Linux version of TSCookie used by BlackTech.[6]

  8. 2020

    Gh0stTimes used

    JPCERT/CC says Gh0stTimes, based on Gh0st RAT, has been used in some attack cases since 2020.[8]

  9. October 2020

    Flagpro in use

    MITRE says Flagpro has been used by BlackTech since at least October 2020.[11]

  10. 16 November 2020

    Linux version of PLEAD

    JPCERT/CC published an article on ELF_PLEAD, the Linux version of PLEAD.[6, 9]

  11. May 2022

    F5 BIG-IP attacks

    JPCERT/CC confirmed attacks on Japanese organizations that exploited F5 BIG-IP flaw CVE-2022-1388. Data in BIG-IP was compromised.[7]

  12. 27 September 2023

    Joint advisory

    CISA, NSA, FBI, Japan NPA and NISC published AA23-270A on BlackTech and router firmware.[2, 3]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about BlackTech threat group profile
DateWhoWhat
15 September 2022 JPCERT Coordination Center Technical reportPublished its analysis of the F5 BIG-IP attacks it considers related to BlackTech.[7]
27 September 2023 CISA, NSA, FBI, Japan NPA, Japan NISC Joint cybersecurity advisoryPublished AA23-270A, People's Republic of China-Linked Cyber Actors Hide in Router Firmware, with detection and mitigation steps.[2]
27 September 2023 CISA Press release and alertAnnounced the advisory and urged critical infrastructure and private sector organizations to apply the mitigations.[3, 4]
27 September 2023 Japan National Police Agency and NISC Warning (Chinese-backed group BlackTech)Issued a joint press release in Japanese alerting organizations and listing example measures.[5]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Obtain Capabilities: Code Signing Certificates T1588.003

    Uses stolen code-signing certificates to sign malicious payloads.[1, 2]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    Sends e-mails with password-protected ZIP or RAR files to deliver malware.[1]

  • Phishing: Spearphishing Link T1566.002

    Sends e-mails with links to cloud services to deliver malware.[1]

  • Exploit Public-Facing Application T1190

    Exploited a flaw in IIS 6.0 (CVE-2017-7269) to set up a server, and an F5 BIG-IP flaw in Japan in 2022.[1, 7]

  • Trusted Relationship T1199

    Uses the trusted link between a branch router and the company network to move from subsidiaries to headquarters.[2, 18]

Execution

  • Exploitation for Client Execution T1203

    Exploited Office and Flash flaws, including CVE-2012-0158, CVE-2014-6352, CVE-2017-0199 and CVE-2015-5119.[1]

  • User Execution: Malicious File T1204.002

    Lures victims with e-mail documents so they install malware.[1]

Persistence

  • Pre-OS Boot: ROMMONkit T1542.004

    Modifies router firmware and the bootloader to keep access.[2, 16]

Lateral Movement

  • Remote Services: SSH T1021.004

    Uses SSH, including Putty, for remote access and to move across a victim network.[1, 2]

Command and Control

  • Traffic Signaling T1205

    Turns the router backdoor on and off with specially crafted TCP or UDP packets.[2]

  • Proxy T1090

    Uses compromised branch routers to proxy traffic and blend in with company traffic.[2]

Stealth

  • Hijack Execution Flow: DLL T1574.001

    Uses DLL side loading with hardcoded DLL names placed in searched directories.[1]

  • Masquerading: Right-to-Left Override T1036.002

    Uses right-to-left override to disguise the names of malicious e-mail attachments.[1]

Defense Impairment

  • Modify System Image: Patch System Image T1601.001

    Patches the router image in memory, then installs modified firmware to avoid detection.[2, 17]

Tools and malware

  • Flagpro First-stage downloader

    MITRE says it is a Windows-based downloader used by BlackTech since at least October 2020, mainly against defense, media and communications companies in Japan.[11, 2]

  • PLEAD Remote access tool and downloader

    MITRE says it was used in attacks in East Asia including Taiwan, Japan and Hong Kong, and seen as early as March 2017. JPCERT/CC also describes a Linux version.[12, 9]

  • TSCookie Remote access tool

    MITRE says it was used in campaigns against Japanese targets. CISA lists FakeDead as another name for it.[13, 2]

  • Waterbear Modular malware

    MITRE says it is attributed to BlackTech and used mainly for lateral movement and for decrypting and triggering payloads.[14, 2]

  • Kivars Remote access tool

    MITRE says it is based on the Bifrost RAT and was used by BlackTech in a 2010 campaign.[15]

  • Gh0stTimes Remote access tool

    JPCERT/CC says it is customized from Gh0st RAT and has been used in some attacks since 2020.[8]

  • Hipid Linux malware

    JPCERT/CC found two types (ARM and x64) on a server holding the F5 BIG-IP attack code. It can receive commands from a server and run them.[7]

  • IconDown Downloader

    JPCERT/CC says BlackTech also uses it, and found it in Japanese organizations. CISA lists it among custom families.[10, 2]

  • Modified router firmware Router backdoor

    CISA says BlackTech replaces router firmware and the bootloader with modified versions that include an SSH backdoor and bypass logging.[2]

  • PsExec, SNScan and Putty Dual-use tools

    MITRE says BlackTech obtained and used these tools. CISA says it used SNScan to map networks.[1, 2]

  • Other families named by CISA Custom malware

    BendyBear, Bifrose, BTSDoor, FrontShell, SpiderPig, SpiderSpring and SpiderStack, built for Windows, Linux and FreeBSD.[2]

Detection and defense

  1. Patch internet-facing systems fast

    JPCERT/CC says the F5 BIG-IP flaw was exploited soon after disclosure, so patch management remains important. The Japan NPA also lists quick patching.

    Counters T1190

  2. Review subsidiary connections

    CISA advises multinational companies to review all subsidiary connections, verify access and consider Zero Trust models to limit a compromise.

    Counters T1199

  3. Watch router and firewall firmware

    Monitor network devices for unauthorized downloads of bootloaders and firmware images and for reboots. Take snapshots of boot records and firmware and compare them with known good images.

    Counters T1542.004 T1601.001

  4. Replace old equipment

    Prioritize replacing end-of-life and unsupported devices with ones that have secure boot and better integrity checks.

    Counters T1542.004 T1601.001

  5. Block outbound connections from network devices

    Apply the transport output none command to VTY lines, and use access lists to stop devices connecting to outside systems.

    Counters T1090

  6. Limit router administration

    Allow admin services only from the IP addresses of network administrators, and log successful and failed logins.

    Counters T1021.004

  7. Watch unusual traffic to routers

    Monitor for unusual traffic sent to the router, including SSH. The backdoor is switched on by crafted packets.

    Counters T1205 T1021.004

  8. Separate admin networks

    Place administrative systems in separate VLANs and block unauthorized traffic from network devices to other VLANs.

    Counters T1199 T1090

What Brandefense can do

  • External Attack Surface Management

    See which routers, branch devices and remote access systems face the internet, so exposed admin pages and unpatched systems can be closed.

  • Cyber Threat Intelligence

    Follow government advisories on BlackTech and match their detection steps to your own network devices.

  • Platform

    Keep advisories, exposed assets and follow-up tasks for subsidiaries and headquarters in one place.

Questions

Who is BlackTech?

The US and Japanese governments (CISA, NSA, FBI, Japan NPA and NISC, 27 September 2023) attribute it to PRC-linked cyber actors. MITRE calls it a suspected Chinese cyber espionage group. Other names include Palmerworm, Temp.Overboard, Circuit Panda and Radio Panda.

Who does BlackTech target?

CISA says government, industrial, technology, media, electronics and telecommunication sectors, including entities that support the militaries of the US and Japan. MITRE names Taiwan, Japan, Hong Kong and the US.

What did the 2023 advisory say about routers?

CISA and partners say BlackTech replaces firmware on some routers with modified firmware that has a hidden SSH backdoor and avoids logging. It then uses branch routers to reach headquarters.

How does BlackTech get in?

MITRE lists spearphishing, malicious documents and exploited flaws. CISA says it uses trusted links between subsidiary routers and headquarters. JPCERT/CC saw an F5 BIG-IP flaw exploited in 2022.

How long has BlackTech been active?

Sources differ. CISA and the Japan NPA say since about 2010. MITRE says since at least 2013.

What should a company do first?

Check branch and subsidiary routers, patch internet-facing systems, and monitor router firmware, reboots and admin access, as the advisory advises.

In our research

  1. BlackTech April 2026

Sources

  1. BlackTech, Palmerworm, Group G0098 MITRE ATT&CK Supports: Group description, techniques, software, start date, associated group
  2. People's Republic of China-Linked Cyber Actors Hide in Router Firmware (AA23-270A) CISA with NSA, FBI, Japan NPA and Japan NISC Supports: Names, aliases, targets, malware, router firmware, mitigations
  3. CISA, NSA, FBI and Japan Release Advisory Warning of BlackTech, PRC-Linked Cyber Activity CISA Supports: Press release, sectors, defense industrial base
  4. NSA, FBI, CISA, and Japanese Partners Release Advisory on PRC-Linked Cyber Actors CISA Supports: Alert, primary targets Japan and the US
  5. 中国を背景とするサイバー攻撃グループBlackTechによるサイバー攻撃について（注意喚起） Japan National Police Agency and NISC Supports: Japanese joint press release, around 2010, targets, router firmware
  6. List of BlackTech JPCERT Coordination Center Supports: Dates of articles on BlackTech malware
  7. F5 BIG-IP Vulnerability (CVE-2022-1388) Exploited by BlackTech JPCERT Coordination Center Supports: May 2022 attacks in Japan, Hipid, TSCookie and Bifrose
  8. Malware Gh0stTimes Used by BlackTech JPCERT Coordination Center Supports: Attacks on Japan since 2018, Gh0stTimes since 2020
  9. ELF_PLEAD - Linux Malware Used by BlackTech JPCERT Coordination Center Supports: Linux version of PLEAD
  10. IconDown - Downloader Used by BlackTech JPCERT Coordination Center Supports: IconDown found in Japanese organisations
  11. Flagpro, Software S0696 MITRE ATT&CK Supports: Flagpro since at least October 2020, Japan
  12. PLEAD, Software S0435 MITRE ATT&CK Supports: PLEAD use and first observation
  13. TSCookie, Software S0436 MITRE ATT&CK Supports: TSCookie use against Japanese targets
  14. Waterbear, Software S0579 MITRE ATT&CK Supports: Waterbear malware
  15. Kivars, Software S0437 MITRE ATT&CK Supports: Kivars 2010 campaign
  16. Pre-OS Boot: ROMMONkit, Technique T1542.004 MITRE ATT&CK Supports: Technique id and name
  17. Modify System Image: Patch System Image, Technique T1601.001 MITRE ATT&CK Supports: Technique id and name
  18. Trusted Relationship, Technique T1199 MITRE ATT&CK Supports: Technique id and name

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

Critical infrastructure

Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more

Technique

Exploit Public-Facing Application

Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.

Read more