BlackTech

THREAT ACTOR PROFILE

BlackTech

BlackTech is a China-linked espionage group active since around 2010, tracked by Trend Micro as Earth Hundun. It targets technology, government and electronics organizations in Japan and Taiwan, and is known for stealthy, long-running intrusions, backdoored router firmware, and the heavily obfuscated Waterbear and Deuterbear malware families.

Country:

China

Category:

Technology / Government

First seen

2010

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

BlackTech, Earth Hundun and Palmerworm

BlackTech carries several vendor names for the same China-linked activity. They map to one entry among the China-linked actors we track, so an Earth Hundun report and a Palmerworm advisory read as one group. It operates in the same space as APT41.

GROUP PROFILE

Quiet espionage against Japan and Taiwan

BlackTech collects intelligence aligned with Chinese interests, focused on technology, government, electronics and media organizations in Japan and Taiwan, with activity across East Asia. It favors stealth and persistence over noise.

Our record places its origin as China and ties it to espionage. The group is notable for compromising network edge devices, including installing backdoored Cisco router firmware to pivot from trusted internal infrastructure.

Its malware is built for evasion: the Waterbear family and its newer Deuterbear variant use anti-analysis and anti-memory-scanning techniques, alongside the KIVARS and Bifrost backdoors and a Linux build of BlueShell.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Edge devices and SSH into stealthy backdoors

The stages below come from BlackTech activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Waterbear, BlueShell and KIVARS

Initial Access

CVES EXPLOITED

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

BlueShell on Linux and the Waterbear line

Recent reporting tracks BlackTech's cross-platform backdoors.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through