Skip to content
brandefense.io
Request A Demo
Nation-state APTIdeologyAdvanced sophistication · State-backed

BlackTech

BlackTech is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 5 countries, including the United States and China. It uses 16 MITRE ATT&CK techniques and exploits 1 known CVE.

Also known as
  • Palmerworm
  • Circuit Panda
  • Radio Panda
  • TEMP.Overboard
  • T-APT-03
  • Red Djinn
  • Manga Taurus
  • Earth Hundun
  • Canary Typhoon
  • G0098
  • Operation “Shrouded Crossbow”
  • Operation “PLEAD”
  • Operation “Waterbear”
Request IOC feedRequest ATT&CK export
Origin
China
Techniques
16
Exploited CVEs
1
First seen
Jan 1, 2010
Last seen
Sep 27, 2023
Record updated

Who They Target.

Sectors · 8
Countries · 5
Labelsbdef-qf:trendingchina-nexuseast-asia-targetingespionagejapan-targetingnetwork-device-compromiseprc-linkedrouter-backdoorrouter-firmwaresubsidiary-pivotingsuspected-activetaiwan-targeting

About BlackTech.

BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology. Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.

Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.