🇨🇳

Blackwood

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 3

Countries highlighted in red

China Japan United States

Sectors Targeted

Manufacturing Offices of Other Health Practitioners 6213

Details

Origin 🇨🇳 CN

Last Updated 03 Feb 2024

Malware Families 1

nspx30

MITRE ATT&CK 48

T1001 T1012 T1014 T1016 T1020 T1027 T1030 T1033 T1036 T1041 T1048 T1049 T1056 T1059 T1059.001 T1070 T1071 T1071.001 T1074 T1082 T1083 T1090 T1095 T1104 T1106 T1112 T1113 T1119 T1123 T1132 T1134 T1140 T1189 T1195 T1202 T1218 T1518 T1546 T1547 T1548 T1555 T1557 T1560 T1562 T1562.001 T1566 T1574 T1587

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Blackwood ESET

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

China Japan UK

Description

(ESET) Blackwood is a China-aligned APT group active since at least 2018, engaging in cyberespionage operations against Chinese and Japanese individuals and companies. Blackwood has capabilities to conduct adversary-in-the-middle attacks to deliver the implant we named NSPX30 through updates of legitimate software, and to hide the location of its command and control servers by intercepting traffic generated by the implant.

Tools Used 1

NSPX30

Operations 1

2024-01 Blackwood APT Group Has a New DLL Loader https://blog.sonicwall.com/en-us/2024/01/blackwood-apt-group-has-a-new-dll-loader/

Reports & References 1

https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/

ETDA Profile

Blackwood

Origin

China

First Seen 2018

Motivation

Information theft and espionage

View on ETDA APT Groups ↗