MITRE ATT&CKgroup

G0098 BlackTech

Published 2020-05-05 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Palmerworm
Version
2.0
Created
2020-05-05

Description

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.

Related

Uses · MITRE ATT&CK (20)

  • S0696 Flagpro software (malware)
  • S0579 Waterbear software (malware)
  • T1588.002 Tool sub-technique
  • T1588.003 Code Signing Certificates sub-technique
  • T1588.004 Digital Certificates sub-technique
  • S0435 PLEAD software (malware)
  • S0436 TSCookie software (malware)
  • S0437 Kivars software (malware)
  • T1574.001 DLL sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1021.004 SSH sub-technique
  • T1036.002 Right-to-Left Override sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1203 Exploitation for Client Execution technique
  • S0029 PsExec software (tool)
  • T1046 Network Service Discovery technique
  • T1106 Native API technique

References