BlackTech

Overview

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.

Naming & attribution

BlackTech is tracked under 2 names across the industry. It uses 14 documented ATT&CK techniques — more than 40% of the 174 groups tracked here. Activity attributed since at least 2013.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Elderwood China — 5 shared techniques (28% overlap)
• Ferocious Kitten Iran — 4 shared techniques (25% overlap)
• Mofang China — 4 shared techniques (25% overlap)
• Transparent Tribe Pakistan — 5 shared techniques (22% overlap)
• WIRTE — 7 shared techniques (21% overlap)
• EXOTIC LILY — 5 shared techniques (21% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190, T1203
• Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 14 techniques across 6 tactics

Tools & malware (6)

PLEAD · Kivars · PsExec · TSCookie · Flagpro · Waterbear

Reporting (3)

• China cyber attacks: the current threat landscape — Demboski, M., et al
• Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors — Threat Intelligence
• Taiwan says China behind cyberattacks on government agencies, emails — Lee, Y