BlackTech

Actor Type Nation State
Attributed to Nation China
Directly Linked Intrusion Sets Earth Hundun

BlackTech is a cyber espionage group reported as being active since at least 2010 and linked to the People's Republic of China. The group is known by various aliases including Palmerworm, Temp.Overboard, Circuit Panda, and Radio Panda, they have targeted a wide range of sectors in the U.S. and East Asia.

BlackTech employs custom malware payloads and remote access tools (RATs) to compromise victims' systems, particularly network devices. They have developed tailored persistence mechanisms for compromising routers, allowing them to disable logging and abuse trusted domain relationships for lateral movement.

According to reporting, their primary targets include government, industrial, technology, media, electronics, and telecommunication sectors, as well as entities supporting the militaries of the U.S. and Japan.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

BlackTech Threat Reports

Report

People's Republic of China-Linked Cyber Actors Hide in Router Firmware

This Cybersecurity Advisory from CISA and partners details activities of the People's Republic of China (PRC)-linked cyber actors known as ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.