ChinaAttributedPRC-linkedEspionageActive 2010 – 2025BlackTech
Also known asPalmerworm · Circuit Panda · TEMP.Overboard · Radio Panda · T-APT-03 · Red Djinn · Manga Taurus · Earth Hundun · Canary Typhoon · BRONZE CANAL
Summary
PRC-linked actor (US–Japan advisory, Sep 2023; no service publicly named) focused on Taiwan, Japan, Hong Kong and the US, including entities that support the US and Japanese militaries. In 2023 NSA/CISA revealed BlackTech modifies Cisco router firmware to create covert backdoors surviving reboots. Unique hardware-level persistence.
Attribution
No service publicly named
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- NSA, FBI, CISA, Japan NPA and NISC (Government, 2023-09-27)
Joint US–Japan advisory: PRC-linked cyber actors - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected Chinese cyber espionage group
Campaigns 1
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Taiwan critical-infrastructure targeting (NSB 2025 annual assessment) | 2025 | Taiwan | Energy, Healthcare, Communications, Government, Technology | Taiwan National Security Bureau, 'Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025' (2026-01-04) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Resource Development2 | T1588.003Code Signing CertificatesT1588.004Digital Certificates |
|---|---|
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1199Trusted Relationship |
| Persistence2 | T1542.001System FirmwareT1078Valid Accounts |
| Stealth1 | T1036.002Right-to-Left Override |
| Defense Impairment1 | T1601.001Patch System Image |
Malware and tools 5
| Name | Description | Platform |
|---|---|---|
| PLEAD | Backdoor | Windows |
| TSCookie | Backdoor | Windows |
| Custom Cisco Router Implant | Firmware Backdoor | Cisco IOS |
| BendyBear | Modular Backdoor | Windows |
| FlagPro | Backdoor | Windows |
Exploited vulnerabilities 5
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2017-7269 | 9.8 | Microsoft IIS 6.0 WebDAV — buffer overflow RCE (KEV 2021-11-03) |
| CVE-2012-0158 | 8.8 | Microsoft Windows Common Controls (MSCOMCTL.OCX) — RCE (KEV 2021-11-03) |
| CVE-2014-6352 | 7.8 | Microsoft Windows OLE — RCE (KEV 2022-02-25) |
| CVE-2015-5119 | 7.8 | Adobe Flash Player — use-after-free RCE (KEV 2022-03-03) |
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Compromised branch routers as proxies to pivot from subsidiaries to HQ in Japan and the US (NSA, FBI, CISA, NPA, NISC, 2023)
Reporting and advisories 3
- CISA
AA23-270A — BlackTech Cisco Router Firmware Implants - Taiwan National Security Bureau
Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025 (4 Jan 2026) - MITRE ATT&CK
BlackTech (G0098) group profile