Blackfly

Threat Actor Profile Updated 3 months ago

Download STIX

Preview STIX

Blackfly is a threat actor, tracked by Symantec, that has been involved in cyber-attacks primarily targeting South Korean companies, especially those in the video game and software development industry. The group initiated its activities with a campaign to steal certificates, which were later utilized to sign malware for targeted attacks. Notably, Blackfly stole a certificate from a company less than two years after another threat actor named Suckfly had stolen a certificate from the same entity. This indicates a shared modus operandi between the two groups, suggesting possible links or common origins. The activities of Blackfly have been linked with multiple Chinese threat groups, including APT 41, also known as Redfly, Winnti, Wicked Panda, or Blackfly. These connections are further complicated by the presence of other subgroups within Winnti, such as Greyfly and Redfly (aka Red Echo), creating challenges in clustering and attribution. The use of similar tools, such as the remote access Trojan (RAT) PlugX, by these groups, including Blackfly and MustangPanda, further blurs the lines of attribution. Recent power grid attacks have been associated with Redfly, which is distinct from both Blackfly and Grayfly. While Symantec does not attribute Redfly to any specific nation, previous reports have closely linked the related groups Blackfly and Greyfly to China. This complex web of associations and overlapping activities underscores the sophisticated and interconnected nature of modern cyber threats, emphasizing the need for comprehensive and nuanced cybersecurity strategies.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
APT41	3	APT41, also known as Winnti, Wicked Panda, and Wicked Spider, is a sophisticated threat actor attributed to China. This group has been active since at least 2012, targeting organizations across 14 countries. The group is known for its extensive use of various code families and tools, with at least 4
Redfly	3	RedFly, a threat actor group known for its malicious activities, has emerged as a significant cybersecurity concern. The group's operations are characterized by their strategic execution and targeted focus, often resulting in substantial security breaches. Threat actors like RedFly pose a significan
Winnti	2	Winnti is a sophisticated threat actor group, first identified by Kaspersky in 2013, with activities dating back to at least 2007. The group has been associated with the Chinese nation-state and is part of a collective known as APT41, which also includes subgroups like Wicked Panda, Suckfly, and Bar
Barium	1	Barium, also known as BRONZE ATLAS and part of the APT41 collective, is a China-linked cyberespionage group that has been active since at least 2007. It is associated with several other subgroups, including Wicked Panda, Winnti, Suckfly, and Blackfly. This threat actor has been responsible for vario
Mustangpanda	1	None

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Symantec

Apt

Cybereason

Poc

Rootkit

Backdoor

China

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
PlugX	Unspecified	1	PlugX is a notorious malware, typically associated with Chinese threat actors, that has been used in various cyberattacks. This malicious software infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data for ransom. It
ZxShell	Unspecified	1	ZXShell is a malicious software (malware) that has been used by various cyber threat actors to exploit and damage computer systems. It is known to be associated with other malware such as PANDORA, SOGU, GHOST, WIDEBERTH, QUICKPULSE, FLOWERPOT, QIAC, Gh0st, Poison Ivy, BEACON, HOMEUNIX, STEW, among o
ShadowPad	Unspecified	1	ShadowPad is a modular backdoor malware that has been utilized by several Chinese threat groups since at least 2017. Notably, it was used as the payload in supply chain attacks targeting South Asian governments, as reported in the VB2023 paper. ShadowPad provides near-administrative capabilities in

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Greyfly	Unspecified	2	None
Redhotel	Unspecified	1	RedHotel, also known as Aquatic Panda, ControlX, and Bronze University, is a threat actor linked to Chinese state-sponsored cyber groups. It is part of a sophisticated network of espionage operations including RedAlpha, Poison Carp, and i-SOON, which are primarily involved in the theft of telecommun
Bronze Atlas	Unspecified	1	Bronze Atlas, also known as APT41, Winnti Group, or HOODOO, is a significant threat actor identified in the cybersecurity industry. The group has been involved in various malicious activities and has been tracked by Secureworks' Counter Threat Unit since at least 2007. According to Marc Burnard, a s
Red Echo	Unspecified	1	Red Echo, also known as Redfly, is a subgroup within the larger threat actor group Winnti. This group has been identified as responsible for a series of cyber-attacks with malicious intent, targeting various entities globally. In a recent campaign, Red Echo managed to infiltrate and occupy the netwo
Lancefly	Unspecified	1	Lancefly, a threat actor potentially associated with China, has been identified as the group behind an ongoing cyberespionage campaign targeting organizations in South and Southeast Asia. The targets include government bodies, aviation companies, educational institutions, and telecommunication secto
Suckfly	Unspecified	1	Suckfly, an advanced threat group, has been identified as conducting targeted attacks using multiple stolen certificates, hacktools, and custom malware. This group is not the only one to use certificates to sign malware, but they are possibly the most prolific collectors of them. The group's broad a

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Winnti/pasteboy	Unspecified	1	None

Source Document References

Information about the Blackfly Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
DARKReading	a year ago	RedHotel Checks in as Dominant China-Backed Cyberspy Group
CERT-EU	10 months ago	Chinese Redfly Hacked National Power Grid & Maintained Access for 6 Months
DARKReading	10 months ago	China's Winnti APT Compromises National Grid in Asia for 6 Months
CERT-EU	10 months ago	China-Linked 'Redfly' Group Targeted Power Grid
InfoSecurity-magazine	10 months ago	Redfly Group Compromises National Power Grid
CERT-EU	a year ago	Chinese APT Targets Hong Kong in Supply Chain Attack
MITRE	a year ago	Endpoint Protection - Symantec Enterprise
DARKReading	a year ago	China's BlackFly Targets Materials Sector in 'Relentless' Quest for IP
BankInfoSecurity	a year ago	Threat Actor Uses Merdoor Backdoor to Hit Asian Orgs