BlackTech
- ID
- G0098
- Associated names
- Palmerworm
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.[1][2][3]
Techniques used (14)
- T1021.004 SSH
- T1036.002 Right-to-Left Override
- T1046 Network Service Discovery
- T1106 Native API
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1574.001 DLL
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1588.004 Digital Certificates