{"id":66933,"date":"2024-01-26T11:14:30","date_gmt":"2024-01-26T17:14:30","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=66933"},"modified":"2024-01-26T11:14:30","modified_gmt":"2024-01-26T17:14:30","slug":"cyberespionage-unveiled-the-blackwood-threat-actor-and-the-advanced-nspx30-malware","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/cyberespionage-unveiled-the-blackwood-threat-actor-and-the-advanced-nspx30-malware\/","title":{"rendered":"Cyberespionage Unveiled: The Blackwood Threat Actor and the Advanced NSPX30 Malware"},"content":{"rendered":"\n

An unidentified advanced threat actor, known as ‘Blackwood,’ has been conducting cyberespionage attacks since at least 2018, utilizing a sophisticated malware called NSPX30.<\/p>\n\n\n\n

Discovered by cybersecurity company ESET in 2020, Blackwood’s activities align with Chinese state interests, with targets in China, Japan, and the UK. The NSPX30 malware is delivered through the update mechanisms of legitimate software such as WPS Office, Tencent QQ, and Sogou Pinyin.<\/p>\n\n\n\n

Blackwood employs adversary-in-the-middle (AitM) attacks, intercepting NSPX30 traffic to conceal its operations and hide command and control servers.<\/p>\n\n\n\n

PC Matic<\/a> Application Allowlisting prevents cybercriminals from running malware on your network and endpoints to disrupt operations, steal sensitive data, encrypt files, or hold critical digital assets for ransom.<\/p>\n\n\n\n

Additionally, users enjoy the advantages of a VPN for online freedom, premium identity theft protection, bank and credit monitoring, dark web monitoring, and 100% USA-based phone support.<\/p>\n\n\n\n

NSPX30’s primary function is data collection, including files, screenshots, key presses, hardware\/network data, and credentials. It can steal chat logs from various platforms and perform actions like terminating processes, creating a reverse shell, moving files, or self-uninstallation.<\/p>\n\n\n\n

Blackwood’s distinctive method involves delivering NSPX30 by intercepting unencrypted HTTP communication during legitimate software update requests (Tencent QQ, WPS Office, Sogou Pinyin), from a different typical supply-chain compromise. The mechanism enabling this interception remains unknown, with speculation that it may involve implants in the target’s network, potentially on vulnerable appliances like routers or gateways.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n\n\n\n
<\/div>\n\n\n\n

PC Matic delivers complete home and business cybersecurity protection against ransomware, malware, identity theft, online tracking, data breaches, and more. For over 20 years, PC Matic’s award-winning cyber protection has saved millions of satisfied customers from becoming the next cybercrime victim and is exclusively made in the USA.
Learn more about PC Matic today!
pcmatic.com<\/a>
sales@pcmatic.com<\/p>\n\n\n\n