BlackTech

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: Palmerworm

CyberCHN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsPalmerworm

ProliferationOrigin country only

Active since2013At least 2013Med^[1]

MITRE ATT&CK IDG0098High^[1]

Capabilities

ATT&CK techniques used14ATT&CK v20.1High^[1]

Malware and toolsFlagpro, Kivars, PLEAD, PsExec, TSCookie, Waterbear6 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorSuspected Chinese groupMed^[1]

TargetsBlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013.Med^[1]

Notes

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

China

Sources

BlackTech, Group G0098, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0098)