From fe7c0dab079f4565baa37123e6ffe329e58afec1 Mon Sep 17 00:00:00 2001 From: Still Hsu Date: Sat, 8 May 2021 00:32:39 +0800 Subject: [PATCH] Add country origin for BlackTech Signed-off-by: Still Hsu --- clusters/threat-actor.json | 1 + 1 file changed, 1 insertion(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 0047391..5971b41 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -7258,6 +7258,7 @@ { "description": "BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology.\nFollowing their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.\nPLEAD is an information theft campaign with a penchant for confidential documents. Active since 2012, it has so far targeted Taiwanese government agencies and private organizations. PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool. PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services. Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO.\nPLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server. This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.", "meta": { + "country": "CN", "refs": [ "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/", "https://www.welivesecurity.com/2018/07/09/certificates-stolen-taiwanese-tech-companies-plead-malware-campaign/",