BlackTech
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--6fe8a2a1-a1b0-4af8-953d-4babd329f8f8
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- CN
MITRE ATT&CK Techniques (14)
Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They incl
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of ca
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary ma
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to
Software & Tools (6)
Flagpro is a Windows-based, first-stage downloader that has been used by [BlackTech](https://attack.mitre.o
Kivars is a modular remote access tool (RAT), derived from the Bifrost RAT, that was used by [BlackTech](ht
PLEAD is a remote access tool (RAT) and downloader used by [BlackTech](https://attack.mitre.org/groups/G009
PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT
TSCookie is a remote access tool (RAT) that has been used by [BlackTech](https://attack.mitre.org/groups/G0
Waterbear is modular malware attributed to BlackTech that has been
Explore this actor's full graph with Ninja Signal