Início / Grupos de ameaça / BlackTech
BlackTech G0098
Também conhecido como: Palmerworm
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
5
CVEs associadas
15
Técnicas
6
Malwares e ferramentas
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
“BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.”
CVE-2017-0199
Alta · 7.8
KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
“BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.”
Técnicas por tática
Desenvolvimento de recursos
T1588.002 ToolT1588.003 Code Signing CertificatesT1588.004 Digital Certificates Acesso inicial
T1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link Execução
T1106 Native APIT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1574.001 DLL Furtividade
T1036.002 Right-to-Left OverrideT1574.001 DLL Descoberta
T1046 Network Service Discovery Movimento lateral
T1021.004 SSH © The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.