Cyber threats / Threat actors

Blackgear

CN Suspected sponsor: China
0
APAC targets
0
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: Comnie, Topgear

BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released covering this campaign, which used the ELIRKS backdoor when it was first discovered in 2012. It is known for using blogs and microblogging services to hide the location of its actual command-and-control (C&C) servers. This allows an attacker to change the C&C server used quickly by changing the information in these posts.
Like most campaigns, BLACKGEAR has evolved over time. Our research indicates that it has started targeting Japanese users. Two things led us to this conclusion: first, the fake documents that are used as part of its infection routines are now in Japanese. Secondly, it is now using blogging sites and microblogging services based in Japan for its C&C activity.

ATT&CK techniques
MITRE ATT&CK has no technique mapping for this actor.
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References
Sources: MISP