Threat intelligence / Group

BlackTech

[BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://attack.mitre.org/groups/G0098) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://attack.mitre.org/groups/G0098) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)

20 recorded

Relationships

uses

to Code Signing Certificates

Technique

uses

to Digital Certificates

Technique

uses

to DLL

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploit Public-Facing Application

Technique

uses

Malware

uses

Malware

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

to Network Service Discovery

Technique

uses

Malware

uses

Tool

uses

to Right-to-Left Override

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to SSH

Technique

uses

Technique

uses

Malware

uses

Malware

6 external

References

mitre-attack

G0098

Palmerworm

—

TrendMicro BlackTech June 2017

https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/

IronNet BlackTech Oct 2021

https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape

Reuters Taiwan BlackTech August 2020

https://www.reuters.com/article/us-taiwan-cyber-china/taiwan-says-china-behind-cyberattacks-on-government-agencies-emails-idUSKCN25F0JK

Symantec Palmerworm Sep 2020

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt