Palmerworm (aka BlackTech): Espionage Gang Targets the Media, Finance, and Other Sectors

mood · Sep 29, 2020

These hackers have spent months hiding out in company networks undetected
...as part of an information stealing campaign, warns Symantec
September 29, 2020
https://www.zdnet.com/article/these...hs-hiding-out-in-company-networks-undetected/

A cyber espionage campaign is using new malware to infiltrate targets around the world including organisations in media, finance, construction and engineering.

Detailed by cybersecurity company Symantec, the attacks against organisations in the US, Japan, Taiwan and China are being conduced with the aim of stealing information and have been linked to an espionage group known as Palmerworm – aka BlackTech – which has a history of campaigns going back to 2013.
The addition of an US target to this campaign suggests the group is expanding campaigns to embrace a wider, more geographically diverse set of targets in their quest to steal information - although the full motivations remain unclear.
Click to expand...

"The group is savvy enough to move with the times and follow the trend of using publicly available tools where they can in order to minimise the risk of discovery and attribution," said Dick O'Brien principal on the threat hunter team at Symantec. "Like many state sponsored attackers, they seem to be minimising the use of custom malware, deploying it only when necessary".

Symantec haven't attributed Palmerworm to any particular group, but Taiwanese officials have previously claimed that the attacks can be linked back to China.
Click to expand...

However, what is certain is that whoever Palmerworm is working on behalf of, the group is unlikely to have ceased operations and will remain a threat.

"Give how recent some of the activity is, we consider them still active. The level of retooling we've seen, with four new pieces of custom malware, is significant and suggests a group with a busy agenda," said O'Brien.
Click to expand...

Symantec: Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors

Companies in Japan, Taiwan, U.S., and China among victims
The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.

Palmerworm uses a combination of custom malware, dual use tools, and living-off-the-land tactics in this campaign. Palmerworm has been active since at least 2013, with the first activity seen in this campaign in August 2019.
Click to expand...

How do we know this is Palmerworm?
While the custom malware used in this attack is not malware we have seen used by Palmerworm before, some of the samples identified in this research are detected by other vendors as PLEAD, which is a known Palmerworm (aka Blacktech) malware family. We also saw the use of infrastructure that has previously been attributed to Palmerworm.
Click to expand...

mood · Dec 28, 2021

New Flagpro malware linked to Chinese state-backed hackers
December 28, 2021

BlackTech cyber-espionage APT (advanced persistent threat) group has been spotted targeting Japanese companies using novel malware that researchers call ‘Flagpro’.

The threat actor uses Flagpro in the initial stage of an attack for network reconnaissance, to evaluate the target’s environment, and to download second-stage malware and execute it.
Click to expand...

Flagpro v2.0
At some point in their analysis, NTT researchers noticed a new version of Flagpro, which can automatically close dialogs relevant to establishing external connections that could reveal its presence to the victim.

“In the implementation of Flagpro v1.0, if a dialog titled “Windows セキュリティ” is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog,” explains the NTT Security report.
“This handling also works when the dialog is written in Chinese or English. It indicates the targets are in Japan, Taiwan, and English-speaking countries.”
Click to expand...

Likely a Chinese actor
BlackTech APT is a lesser-known actor that TrendMicro researchers first spotted in the summer of 2017 and is associated with China.

In February 2021, a Unit 42 report connected BlackTech to WaterBear; another cyber-espionage group believed to be backed by the Chinese government.
As an APT, BlackTech possesses the knowledge and sophistication to adjust its tools to new reports like this one, so Flagpro will likely now be modified for stealthier deployment.
Click to expand...

NTT Security: Flagpro: The new malware used by BlackTech

BlackTech has been actively attacking, some attack cases against Japanese companies were observed. BlackTech uses a new malware for these attack cases. We call it “Flagpro”. We are sharing its overview, timeline and detailed analysis result in this article.

We have observed attack cases using Flagpro against multiple companies (Defense, Media, Communications) several times. In October 2020, a sample related to Flagpro was submitted to an online service. Therefore, Flagpro may have already been used for attacking cases at that point.
Click to expand...

Log in or Sign up

Palmerworm (aka BlackTech): Espionage Gang Targets the Media, Finance, and Other Sectors

mood Updates Team

mood Updates Team