Blackfly

Threat Actor Profile Updated 24 days ago
Download STIX
Preview STIX
Blackfly is a threat actor, tracked by Symantec, that has been involved in cyber-attacks primarily targeting South Korean companies, especially those in the video game and software development industry. The group initiated its activities with a campaign to steal certificates, which were later utilized to sign malware for targeted attacks. Notably, Blackfly stole a certificate from a company less than two years after another threat actor named Suckfly had stolen a certificate from the same entity. This indicates a shared modus operandi between the two groups, suggesting possible links or common origins. The activities of Blackfly have been linked with multiple Chinese threat groups, including APT 41, also known as Redfly, Winnti, Wicked Panda, or Blackfly. These connections are further complicated by the presence of other subgroups within Winnti, such as Greyfly and Redfly (aka Red Echo), creating challenges in clustering and attribution. The use of similar tools, such as the remote access Trojan (RAT) PlugX, by these groups, including Blackfly and MustangPanda, further blurs the lines of attribution. Recent power grid attacks have been associated with Redfly, which is distinct from both Blackfly and Grayfly. While Symantec does not attribute Redfly to any specific nation, previous reports have closely linked the related groups Blackfly and Greyfly to China. This complex web of associations and overlapping activities underscores the sophisticated and interconnected nature of modern cyber threats, emphasizing the need for comprehensive and nuanced cybersecurity strategies.
What's your take? (Question 1 of 5)
331b9d26-615f-4238-8314-765fcf14cf72 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Redfly
3
RedFly, a threat actor group known for its malicious activities, has emerged as a significant cybersecurity concern. The group's operations are characterized by their strategic execution and targeted focus, often resulting in substantial security breaches. Threat actors like RedFly pose a significan
APT41
3
APT41, also known as Winnti, Wicked Panda, Barium, Suckfly, Earth Freybug, and Daggerfly, is a China-attributed threat actor that has been active since at least 2012. The group has targeted organizations across at least 14 countries, focusing on entities in the South China Sea region. APT41's activi
Winnti
2
Winnti, also known as Starchy Taurus, APT41, Axiom, Barium, Blackfly, and HOODOO, is a prominent threat actor originating from China. The group has been active since at least 2007 and is notorious for its sophisticated cyberespionage campaigns. The group's activities have been linked to a shared Chi
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Symantec
Apt
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
GreyflyUnspecified
2
None
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Blackfly Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
DARKReading
a year ago
China's BlackFly Targets Materials Sector in 'Relentless' Quest for IP
MITRE
a year ago
Endpoint Protection - Symantec Enterprise
BankInfoSecurity
a year ago
Threat Actor Uses Merdoor Backdoor to Hit Asian Orgs
DARKReading
10 months ago
RedHotel Checks in as Dominant China-Backed Cyberspy Group
DARKReading
9 months ago
China's Winnti APT Compromises National Grid in Asia for 6 Months
CERT-EU
9 months ago
Chinese APT Targets Hong Kong in Supply Chain Attack
CERT-EU
8 months ago
Chinese Redfly Hacked National Power Grid & Maintained Access for 6 Months
CERT-EU
9 months ago
China-Linked 'Redfly' Group Targeted Power Grid
InfoSecurity-magazine
9 months ago
Redfly Group Compromises National Power Grid