Palmerworm (aka BlackTech): Espionage Gang Targets the Media, Finance, and Other Sectors

mood · Sep 29, 2020

These hackers have spent months hiding out in company networks undetected
...as part of an information stealing campaign, warns Symantec
September 29, 2020
https://www.zdnet.com/article/these...hs-hiding-out-in-company-networks-undetected/

A cyber espionage campaign is using new malware to infiltrate targets around the world including organisations in media, finance, construction and engineering.

Detailed by cybersecurity company Symantec, the attacks against organisations in the US, Japan, Taiwan and China are being conduced with the aim of stealing information and have been linked to an espionage group known as Palmerworm – aka BlackTech – which has a history of campaigns going back to 2013.
The addition of an US target to this campaign suggests the group is expanding campaigns to embrace a wider, more geographically diverse set of targets in their quest to steal information - although the full motivations remain unclear.
Click to expand...

"The group is savvy enough to move with the times and follow the trend of using publicly available tools where they can in order to minimise the risk of discovery and attribution," said Dick O'Brien principal on the threat hunter team at Symantec. "Like many state sponsored attackers, they seem to be minimising the use of custom malware, deploying it only when necessary".

Symantec haven't attributed Palmerworm to any particular group, but Taiwanese officials have previously claimed that the attacks can be linked back to China.
Click to expand...

However, what is certain is that whoever Palmerworm is working on behalf of, the group is unlikely to have ceased operations and will remain a threat.

"Give how recent some of the activity is, we consider them still active. The level of retooling we've seen, with four new pieces of custom malware, is significant and suggests a group with a busy agenda," said O'Brien.
Click to expand...

Symantec: Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors

Companies in Japan, Taiwan, U.S., and China among victims
The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.

Palmerworm uses a combination of custom malware, dual use tools, and living-off-the-land tactics in this campaign. Palmerworm has been active since at least 2013, with the first activity seen in this campaign in August 2019.
Click to expand...

How do we know this is Palmerworm?
While the custom malware used in this attack is not malware we have seen used by Palmerworm before, some of the samples identified in this research are detected by other vendors as PLEAD, which is a known Palmerworm (aka Blacktech) malware family. We also saw the use of infrastructure that has previously been attributed to Palmerworm.
Click to expand...

Log in or Sign up

Palmerworm (aka BlackTech): Espionage Gang Targets the Media, Finance, and Other Sectors

mood Updates Team

Log in or Sign up

Palmerworm (aka BlackTech): Espionage Gang Targets the Media, Finance, and Other Sectors

mood Updates Team

Useful Searches