Palmerworm

Threat Actor updated 5 months ago (2024-05-04T18:01:28.979Z)
Download STIX
Preview STIX
Palmerworm, also known as BlackTech, Temp.Overboard, Circuit Panda, and Radio Panda, is a threat actor group that has been active since at least 2013. This group has demonstrated extensive capabilities in targeting various sectors such as government, industrial, technology, media, electronics, and telecommunication, including entities supporting the militaries of the U.S. and Japan. Their operations have primarily focused on East Asia, specifically Taiwan, Japan, and Hong Kong, since 2007. Palmerworm's activities in a recent campaign were first noticed in August 2019 when they infiltrated the networks of a Taiwanese media company and a Chinese construction company. The Cybersecurity and Infrastructure Security Agency (CISA) has recognized Palmerworm for its adeptness in modifying router malware without detection and exploiting routers' domain-trust relationships to gain access to victim networks. The group maintained a presence on the networks of a construction and finance company for several months, indicating their persistent approach. Despite no clear evidence on the infection vector used by Palmerworm in this particular campaign, previous instances have documented the group's use of spear-phishing emails to gain initial network access. In addition to their sophisticated intrusion methods, Palmerworm has been publicly reported to use stolen code-signing certificates in prior attack campaigns. This aligns with their strategy of using "living-off-the-land" tactics, which involve exploiting dual-use tools commonly used by legitimate users. These advanced persistent threat (APT) groups like Palmerworm have increasingly adopted such tactics in recent years, making them a significant concern for cybersecurity agencies across the globe.
Description last updated: 2024-04-04T00:16:00.857Z
What's your take? (Question 1 of 2)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
BlackTech is a possible alias for Palmerworm. BlackTech, a China-linked Advanced Persistent Threat (APT) group, poses a significant cybersecurity threat due to its sophisticated and covert hacking activities. As a threat actor, BlackTech's operations involve executing actions with malicious intent, which can be attributed to individuals, privat
3
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Apt
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the Palmerworm Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more