CVE Intelligence
Home / Threat actors / BlackTech

BlackTech G0098

🔔 Create alert

Also known as: Palmerworm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

5
associated CVEs
15
Techniques
6
Malware and tools

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-7269 Critical · 9.8 KEV Microsoft Windows Server Buffer Overflow Vulnerability
“BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
CVE-2015-5119 Critical · 9.8 KEV Adobe Flash Player Use-After-Free Vulnerability
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
CVE-2014-6352 High · 7.8 KEV Microsoft Windows Code Injection Vulnerability
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
CVE-2012-0158 High · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”

Techniques by tactic

Resource Development
T1588.002 ToolT1588.003 Code Signing CertificatesT1588.004 Digital Certificates
Initial Access
T1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1106 Native APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLL
Stealth
T1036.002 Right-to-Left OverrideT1574.001 DLL
Discovery
T1046 Network Service Discovery
Lateral Movement
T1021.004 SSH

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.