BlackTech
MISPUnknown
CN
Unknown
BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology.
Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.
PLEAD is an information theft campaign with a penchant for confidential documents. Active since 2012, it has so far targeted Taiwanese government agencies and private organizations. PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool. PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services. Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO.
PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server. This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.
Techniques Used (14)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1021.004 | SSH | - |
| T1036.002 | Right-to-Left Override | - |
| T1046 | Network Service Discovery | - |
| T1106 | Native API | - |
| T1190 | Exploit Public-Facing Application | - |
| T1203 | Exploitation for Client Execution | - |
| T1204.001 | Malicious Link | - |
| T1204.002 | Malicious File | - |
| T1566.001 | Spearphishing Attachment | - |
| T1566.002 | Spearphishing Link | - |
| T1574.001 | DLL | - |
| T1588.002 | Tool | - |
| T1588.003 | Code Signing Certificates | - |
| T1588.004 | Digital Certificates | - |
References (10)
- blog.trendmicro.com - Following Trail Blacktech Cyber Espionage Campaigns
- welivesecurity.com - Certificates Stolen Taiwanese Tech Companies Plead Malware Campaign
- welivesecurity.com - Plead Malware Mitm Asus Webstorage
- go.crowdstrike.com - Report2020CrowdStrikeGlobalThreatReport.pdf
- slideshare.net - Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko
- symantec-enterprise-blogs.security.com - Palmerworm Blacktech Espionage Apt
- unit42.paloaltonetworks.com - Mangataurus
- pwc.com - Yir Cyber Threats Report Download.pdf
- pwc.co.uk - Pwc Cyber Threats 2020 A Year In Retrospect.pdf
- trendmicro.com - Earth Hundun Waterbear Deuterbear
Aliases (1193)
Related Malware (6)
Metadata
| ID: | 231 |
| Created: | 13/01/2026 17:48 |
| Updated: | 07/03/2026 04:00 |