H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BLACKCOFFEE](https://attack.mitre.org/software/S0069) is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye APT17) (Citation: FireEye Periscope March 2018)

Labels

malware

10 recorded

Relationships

uses

from APT17

Group

uses

from APT41

Group

uses

to Bidirectional Communication

Technique

uses

to Dead Drop Resolver

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Multi-Stage Channels

Technique

uses

to Process Discovery

Technique

uses

to Windows Command Shell

Technique

uses

from Leviathan

Group

4 external

References

mitre-attack

S0069

open

BLACKCOFFEE

—

FireEye APT17

https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf

open

FireEye Periscope March 2018

https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

open