Blackfly

Blackfly is a threat actor, tracked by Symantec, that has been involved in cyber-attacks primarily targeting South Korean companies, especially those in the video game and software development industry. The group initiated its activities with a campaign to steal certificates, which were later utilized to sign malware for targeted attacks. Notably, Blackfly stole a certificate from a company less than two years after another threat actor named Suckfly had stolen a certificate from the same entity. This indicates a shared modus operandi between the two groups, suggesting possible links or common origins. The activities of Blackfly have been linked with multiple Chinese threat groups, including APT 41, also known as Redfly, Winnti, Wicked Panda, or Blackfly. These connections are further complicated by the presence of other subgroups within Winnti, such as Greyfly and Redfly (aka Red Echo), creating challenges in clustering and attribution. The use of similar tools, such as the remote access Trojan (RAT) PlugX, by these groups, including Blackfly and MustangPanda, further blurs the lines of attribution. Recent power grid attacks have been associated with Redfly, which is distinct from both Blackfly and Grayfly. While Symantec does not attribute Redfly to any specific nation, previous reports have closely linked the related groups Blackfly and Greyfly to China. This complex web of associations and overlapping activities underscores the sophisticated and interconnected nature of modern cyber threats, emphasizing the need for comprehensive and nuanced cybersecurity strategies.