BlackwoodThreat actor
Blackwood is a China-aligned APT group that has been active since at least 2018. They primarily engage in cyberespionage operations targeting individuals and companies in China, Japan, and the United Kingdom. Blackwood utilizes sophisticated techniques such as adversary-in-the-middle attacks to deliver their custom implant, NSPX30, through updates of legitimate software.From MISP Galaxy
Last reported 18 days ago, by Palo Alto Unit 421 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1047Windows Management Instrumentation
“Windows Management Instrumentation (WMI)”
- T1127Trusted Developer Utilities Proxy Execution
“This technique is classified as Trusted Developer Utilities Proxy Execution.”
- T1684Social Engineering
“The attackers used tailored social engineering tactics, weaponizing recruitment lures aimed at Iraqi software developers and engineers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“…aged command execution via the previously analyzed PsProxy.dll PowerShell module and served as the staging mechanism for deploying the Blackwood tunneling tool into the network, which we analyze in detail in the following section.”
Indicators in its reports
named in the reports above- hxxps://api.github[.]com/repos/peakyblinders-tm/myLic/contents/in 1 report
- 91.107.156[.]29in 1 report
- 6e7d9b33f1e72ea1…de9ecd1fd239in 1 report
- f5b12772db6817f7…4a372a410fc9in 1 report
- 53f35e49eb9b271f…be0363daa402in 1 report
- 3fd810a3aa003999…0887cdd3ed13in 1 report
- 76273382e4252c1f…891762c0682ein 1 report
- d3561bd4aad003dc…08ab1d4e8260in 1 report
- 65.109.214[.]145in 1 report
- f5ba1645694c62f5…37e72803b4bdin 1 report
- 87.248.129[.]239in 1 report
- 7cc571aca6d8715d…7c5d00a1f875in 1 report
- 38.180.136[.]127in 1 report
- googeldrive[.]camin 1 report
- drivegoogel[.]camin 1 report
- googelmeet[.]onlinein 1 report
- meetonline[.]camin 1 report
- asdfafadafg[.]onlinein 1 report
- hxxps://github[.]com/peakyblinders-tmin 1 report
- hxxps://github[.]com/GreenBeret0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.