BlackTech turns the router at a small overseas branch into a trusted, silent path into headquarters, by replacing the device's firmware with a version that hides its own commands and lets the operators in through a backdoor. This profile covers the group MITRE ATT&CK tracks as G0098, also known as Palmerworm, active against East Asian and US organisations for more than a decade. It draws on MITRE ATT&CK v20, the September 2023 joint advisory from NSA, FBI, CISA, Japan's National Police Agency (NPA) and Japan's National Center of Incident Readiness and Strategy for Cybersecurity (NISC), Symantec and Trend Micro, and follows each source's attribution wording. It is written for network engineers, SOC teams and security leaders at multinationals with subsidiaries in East Asia, and it stays at behaviour level. For the wider context, see the China State Cyber Operations Guide.
Key takeaways
- Branch routers are the pivot. The 2023 joint advisory describes BlackTech compromising subsidiaries and using trusted connections and branch routers to reach headquarters networks in Japan and the US.
- Firmware is replaced, not just reconfigured. The advisory describes modified Cisco IOS firmware and bootloaders that carry an SSH backdoor and bypass logging and access control lists (ACLs).
- Signatures will not save you. The agencies warn that indicators tied to specific backdoor values are easily changed; monitor firmware integrity, unexpected reboots and router management traffic instead.
- The Windows side is classic espionage. ATT&CK records spearphishing with RTLO-disguised attachments, DLL side-loading, stolen code-signing certificates and custom families such as PLEAD, TSCookie, Flagpro and Waterbear.
- Device credentials are identities too. Router local accounts, SSH keys and AAA trust decide how far a firmware backdoor or a stolen password can travel.
Who they are (names and aliases)
MITRE ATT&CK describes BlackTech as a suspected Chinese cyber espionage group that has primarily targeted organisations in East Asia, particularly Taiwan, Japan and Hong Kong, and the US since at least 2013. The 2023 joint advisory describes BlackTech actors as linked to the People's Republic of China and says they have been active since 2010. Symantec, which tracks the group as Palmerworm, does not attribute its activity to any specific geography, and notes that Taiwanese officials have publicly said the group is backed by the Chinese government.
| Name | Source | Notes |
|---|---|---|
| BlackTech (G0098) | MITRE ATT&CK; Trend Micro | Trend Micro linked the PLEAD, Shrouded Crossbow and Waterbear campaigns to one group in 2017, citing shared command and control servers |
| Palmerworm | Symantec; MITRE ATT&CK | Used in Symantec's 2020 campaign reporting |
| Temp.Overboard, Circuit Panda, Radio Panda | 2023 joint advisory | Listed as further names for the same actors |
No individuals are named on this page. For Japan-focused peers, see the MirrorFace Threat Actor Profile Guide.
Software associated in ATT&CK
| Software | Type | What ATT&CK and vendors say |
|---|---|---|
| PLEAD (S0435) | Remote access tool and downloader | Used in targeted attacks in Taiwan, Japan and Hong Kong; Trend Micro says the PLEAD campaign favoured confidential documents and paired the backdoor with a tool that uploaded files to attacker-linked Google Drive accounts |
| Kivars (S0437) | Modular remote access tool | Derived from the Bifrost RAT; used in a 2010 campaign |
| TSCookie (S0436) | Remote access tool | Used in campaigns against Japanese targets |
| Flagpro (S0696) | First-stage downloader | Used since at least October 2020, mainly against defence, media and communications companies in Japan |
| Waterbear (S0579) | Modular malware | Used mainly for lateral movement and triggering payloads, able to hide network behaviour; Trend Micro saw it as a secondary payload after initial access |
| PsExec (S0029) | Dual-use tool | Used with PuTTY, SNScan and WinRAR in the 2019 to 2020 campaign (Symantec) |
The 2023 advisory adds that the actors use custom malware for Windows, Linux and FreeBSD. For the wider malware class, see the ATT&CK Espionage Backdoors and Implants Software Hub.
Targeting and motivation
- Geography: Taiwan above all, then Japan, Hong Kong and the US (ATT&CK). The joint advisory describes a focus on US and East Asian public and private organisations.
- Sectors: the advisory lists government, industrial, technology, media, electronics and telecommunications, plus entities that support the US and Japanese militaries. Symantec's 2019 to 2020 victims included Taiwanese media, electronics and finance firms, a Japanese engineering company and a construction company in China.
- Motivation: espionage. Trend Micro assessed in 2017 that the campaigns were likely meant to steal technology.
- Dwell time: Symantec saw the group on one Taiwanese media network for about a year and on other victims for months.
- Who should care: multinationals with subsidiaries or joint ventures in East Asia, defence suppliers, electronics and semiconductor manufacturers, and telecoms operators.
Tactics and techniques (MITRE ATT&CK)
Rows marked "advisory" come from the technique list in the 2023 joint advisory, re-checked against ATT&CK v20. Other rows are v20 techniques recorded against G0098.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Resource development | T1588.003 Code Signing Certificates; T1588.002 Tool | Stolen code-signing certificates; PuTTY, SNScan and PsExec | Alert on signer anomalies; application control by publisher and hash |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | Password-protected ZIP or RAR archives and cloud storage links | Block encrypted archives from external senders or sandbox them |
| Initial access | T1190 Exploit Public-Facing Application | IIS 6.0 flaw CVE-2017-7269 to stand up a new HTTP or C2 server | Retire end-of-life web servers |
| Initial access (advisory) | T1199 Trusted Relationship | Moving from a compromised subsidiary to headquarters over trusted links | Treat subsidiary links as untrusted; filter and monitor them |
| Execution | T1203 Exploitation for Client Execution; T1204.002 Malicious File | Office and Flash exploits; decoy documents | Patch Office; block macros and legacy file types |
| Stealth | T1036.002 Right-to-Left Override; T1574.001 DLL | Disguised file names; DLL side-loading with hard-coded names | Mail filtering for RTLO characters; image load monitoring |
| Persistence (advisory) | T1542.004 ROMMONkit | Unsigned bootloader installed after bypassing signature checks | Verify bootloader and image integrity against vendor hashes |
| Defence impairment (advisory) | T1601.001 Patch System Image; T1601.002 Downgrade System Image | Older legitimate image hot-patched in memory, then modified firmware installed | Pin approved images; alert on image changes and reloads |
| Credential access and persistence (advisory) | T1556.004 Network Device Authentication | SSH backdoor with a special username needing no further authentication | Central AAA with logging; integrity checks; rebuild from known-good images |
| Command and control (advisory) | T1205 Traffic Signaling | Crafted TCP or UDP "magic packets" enable or disable the backdoor and exempt the sender from ACLs | Out-of-band management; flow monitoring for odd traffic to router interfaces |
| Lateral movement | T1021.004 SSH; T1021.001 Remote Desktop Protocol (advisory) | PuTTY for remote access; SSH into routers | Restrict management access to jump hosts on a management network |
| Command and control (advisory) | T1090.002 External Proxy; T1071.002 File Transfer Protocols | Branch routers used to proxy traffic; firmware moved over file transfer protocols | Egress filtering on router management planes |
| Discovery | T1046 Network Service Discovery | SNScan to find further targets | Alert on internal scanning |
The advisory also describes a hidden Embedded Event Manager (EEM) policy that strips lines from command output and blocks copy, rename and move commands that would help forensics. It maps that activity to defence evasion IDs that ATT&CK v20 has since reorganised, so this page describes the behaviour rather than repeating retired IDs. See the MITRE ATT&CK T1601 Modify System Image and the MITRE ATT&CK T1205 Traffic Signaling guides.
How they abuse identities and credentials
- Router accounts as backdoors: the modified firmware adds an SSH login with a special username that needs no further authentication and skips command logging. Central AAA logs will not show it, so integrity checks on the image matter as much as account reviews.
- Trusted domain relationships: the advisory describes use of trusted domain relationships between subsidiaries and headquarters. Forest and domain trusts, shared service accounts and site-to-site VPN credentials let access in one country become access everywhere. See the Identity Integration in M&A Guide.
- Stolen code-signing certificates: ATT&CK and Symantec record signed payloads using stolen certificates. A code-signing key is a machine identity; once stolen it lends malware the trust of a real publisher. See the Code Signing Security Guide.
- Network device credentials: shared local passwords, weak type 7 secrets and reused SNMP communities across branch routers turn one compromised device into many. Rotate them per device and store them in a vault.
Notable reporting
| Date | Event | Source |
|---|---|---|
| June 2017 | Trend Micro links PLEAD, Shrouded Crossbow and Waterbear campaigns to BlackTech | Trend Micro |
| August 2019 to August 2020 | Palmerworm campaign against media, electronics, finance, engineering and construction victims in Taiwan, Japan, China and the US | Symantec |
| October 2020 onwards | Flagpro downloader used against Japanese defence, media and communications companies | MITRE ATT&CK |
| 27 September 2023 | Joint advisory "People's Republic of China-Linked Cyber Actors Hide in Router Firmware" from NSA, FBI, CISA, NPA and NISC | NSA; CISA |
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Firmware or bootloader downloads to routers, and unexpected reloads | Syslog, configuration management, NetFlow | The advisory names these as key indicators of firmware replacement |
| Running image hash differs from the approved vendor image | Periodic integrity verification from a trusted host | Modified firmware hides itself from on-box commands |
| Inbound SSH to router interfaces from unexpected sources | Flow data; firewall logs in front of the device | The backdoor and magic packets arrive from outside the management network |
| Gaps in router syslog or AAA accounting | SIEM heartbeat and volume monitoring | Logging is disabled or filtered by the actors |
| Traffic from subsidiary networks to headquarters outside expected services | Inter-site firewall and flow logs | Pivoting over trusted links |
| Signed binaries loading DLLs from user-writable folders | EDR; Sysmon Event ID 7 | DLL side-loading on Windows hosts |
| Attachments containing the RTLO character or encrypted archives from outside | Mail gateway logs | Documented delivery method |
Phased response plan
- Inventory and baseline: list every branch and subsidiary router with model, image and bootloader version, and record vendor hashes for approved images. See the Cisco IOS XE Hardening Guide.
- Lock the management plane: allow SSH only from a management network or out-of-band path, block management from the internet, disable unused services and enforce central AAA with accounting. See the Network Device Management Plane Hardening Guide.
- Watch for change: send syslog and AAA accounting to the SIEM, alert on image, bootloader and EEM changes and on silent devices. See the Network Device Syslog and Configuration Change Detection Guide.
- Segment subsidiaries: treat subsidiary links as external, allow only named services to headquarters and review trusts and shared accounts. Pilot the new rules at one site and keep the old rule set ready to restore.
- Harden Windows endpoints: block RTLO names and encrypted archives at the mail gateway, monitor DLL side-loading and use application control that checks publisher and hash.
- Respond to a suspected compromise: do not trust on-box commands; capture the image for analysis, reload from verified media with a verified bootloader, rotate every credential the device held and involve the vendor. See the Firmware and Bootkit Compromise Playbook.
Decision guidance
- Replace or rebuild: devices that cannot verify their boot chain, or that are end-of-life, are better replaced than cleaned.
- Smaller firms: a managed branch router service with documented image management, plus strict filtering between sites, covers most of the documented chain.
- Large multinationals: add out-of-band management, scheduled offline image verification and zero trust access between subsidiaries and headquarters, as the advisory recommends.
Metrics
- Percentage of branch routers with a verified image hash in the last 30 days.
- Number of routers reachable for management from outside the management network (target zero).
- Percentage of network devices sending syslog and AAA accounting to the SIEM, with silence alerts.
- Number of shared local credentials across network devices (target zero).
- Number of subsidiary-to-headquarters firewall rules allowing any service (target zero).
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Firmware and image integrity | SI-7, CM-14 | PR.PS-02 |
| Configuration baselines for network devices | CM-2, CM-6 | PR.PS-01 |
| Management plane and segmentation | SC-7, AC-17 | PR.IR-01 |
| Device credentials and authentication | IA-3, IA-5 | PR.AA-01 |
| Logging and monitoring | AU-6, SI-4 | DE.CM-01 |
| Supplier and subsidiary connections | SA-9, CA-3 | GV.SC-07 |
Common failure patterns
- Trusting show commands: a modified image can hide its own changes, so on-box checks alone prove nothing.
- Flat links to subsidiaries: full routing between a small overseas office and headquarters gives the actors the pivot the advisory describes.
- Management from anywhere: SSH open on WAN interfaces lets magic packets and backdoor logins arrive directly.
- Logging assumed, not verified: a router that stops sending logs looks the same as a quiet router unless silence raises an alert.
- Cleaning without rotating: reflashing a router but keeping its local passwords, keys and SNMP communities leaves the way back open.
Practitioner checklist
- Inventory branch and subsidiary routers with image and bootloader versions.
- Verify running images against vendor hashes from a trusted host on a schedule.
- Restrict router management to a management network or out-of-band path.
- Alert on image, bootloader and EEM changes, unexpected reloads and log silence.
- Filter subsidiary-to-headquarters traffic to named services and review trusts.
- Use unique, vaulted credentials per network device and rotate after any incident.
- Block RTLO file names and external encrypted archives at the mail gateway.
- Monitor DLL side-loading and signer anomalies on Windows endpoints.
- Replace end-of-life routers that cannot verify their boot chain.
Standards and references
- MITRE ATT&CK: BlackTech (G0098)
- CISA: People's Republic of China-Linked Cyber Actors Hide in Router Firmware (AA23-270A)
- FBI IC3: People's Republic of China-Linked Cyber Actors Hide in Router Firmware (joint advisory PDF)
- NSA: US and Japanese Agencies Issue Advisory About China-Linked Actors Hiding in Router Firmware
- Symantec Threat Hunter Team: Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors
- Trend Micro: The Trail of BlackTech's Cyber Espionage Campaigns
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: China State Cyber Operations Guide · Salt Typhoon Threat Actor Profile · Volt Typhoon Threat Actor Profile · Network Device Management Plane Hardening Guide · MITRE ATT&CK T1199 Trusted Relationship Guide