US security agencies, comprising the FBI and NSA, have issued a stark warning concerning a cyber threat emanating from China. In a joint press release, these agencies have issued a comprehensive cybersecurity advisory (CSA) shedding light on the activities of a nefarious group known as BlackTech. This group possesses the alarming capability to manipulate router firmware clandestinely, evading detection, and exploiting the trust relationships established by these routers. Their primary targets are international subsidiaries with connections leading to headquarters located in Japan and the United States.
BlackTech, known by several aliases including Palmerworm, Temp.Overboard, Circuit Panda, and Radio Panda, primarily targets government entities, industrial sectors, technology firms, media companies, electronics manufacturers, and telecommunications providers. This includes organizations offering support to the military forces of both the United States and Japan. BlackTech employs an arsenal of custom-made malware, versatile tools, and evasive tactics like disabling router logging to conceal their activities.
The agencies’ report highlights BlackTech’s prolonged presence, dating back to 2010, during which they have consistently targeted a broad spectrum of public and private entities in the United States and East Asia. Their modus operandi involves deploying tailored malware payloads and remote access tools (RATs) to compromise operating systems like Windows, Linux, and FreeBSD.
BlackTech’s manipulation of router devices is particularly concerning, as they employ diverse tactics to mask configuration changes, obscure commands, and disable logging, all while conducting their covert operations. The agencies stress the urgency for multinational corporations to rigorously assess subsidiary connections, validate access, and consider adopting Zero Trust models to mitigate the potential threats posed by BlackTech.
In an era where cyber threats are constantly evolving, this advisory serves as a crucial reminder of the ever-present need for vigilance and proactive measures to safeguard critical infrastructure and sensitive information from malicious actors like BlackTech.
