BlackTech Deploys BlueShell Linux Backdoor Against Japanese Organizations — Threadlinqs Intelligence
As of 2026-07-31, BlackTech Deploys BlueShell Linux Backdoor Against Japanese Organizations is a high-severity malware threat attributed to BlackTech (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1803 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: BlackTech · China · ESPIONAGE
BlackTech, a China-aligned APT group, is deploying a Linux variant of the open-source, Go-based BlueShell RAT against Japanese enterprise environments. The backdoor masquerades as a kernel worker
IIJ-SECT (Internet Initiative Japan) analysts identified three new Linux samples of the BlueShell backdoor, uploaded to VirusTotal from Indonesia and Singapore in May 2026, and attributed the activity to the China-aligned espionage group BlackTech (aka Palmerworm, Temp.Overboard, Circuit Panda, Radio Panda). BlueShell is an open-source, Go-based, cross-platform (Windows/Linux/macOS) RAT originally published on GitHub with Chinese-language documentation; the original repository has since been removed but the source persists in forks, and multiple China-nexus actors (including the unrelated Dalbit group) have independently repurposed it.
In this campaign, a purpose-built dropper is deployed to hosts BlackTech has already reached laterally, typically via SSH using stolen or weak credentials. The dropper carries an embedded payload (0x21E3BA bytes in its .data section) that it XOR-decodes with a single-byte key (0x63) and decompresses with FastLZ, writing the resulting BlueShell binary to /tmp/kthread before executing it and deleting the dropper from disk — leaving only the in-memory-resident backdoor. At runtime the process sets argv[0] to a string such as "[kworker/12:12]" to masquerade as a Linux kernel worker thread, defeating naive process-listing review. Its C2/proxy/sleep configuration is Base64- and XOR-encoded and passed via an environment variable (observed name: "wtim"), and includes the C2 host/port, a retry sleep interval (666s in the analyzed sample), a hostname gate, and internal-proxy address/port/username/password. C2 sessions run over TLS and only proceed if the presented X.509 certificate's Common Name contains one of a small allow-list of strings ("microsoft", "google", "cloudflare", "centos", "ubuntu") — a lightweight anti-sandboxing/anti-interception check rather than genuine certificate validation. The observed C2 endpoint, 48.216.210.91:443, sits in Microsoft Azure space (AS8075).
The defining evolution in this variant is proxy-aware C2 routing: rather than reaching out directly to the internet, BlueShell can pivot its C2 traffic through the victim's own authenticated internal proxy (in the analyzed sample, 10.210.20.254:3128 — a default Squid deployment, with a hardcoded credential pair test/test), making outbound C2 traffic blend in with legitimate proxied enterprise traffic and bypass perimeter egress controls that assume direct-to-internet connections are the only exfiltration path. IIJ-SECT notes this capability is absent from pre-2023 BlueShell samples and has been consistently present in samples observed from 2024 onward, indicating deliberate, ongoing tradecraft investment. The backdoor exposes a compact command set (sleep/interval control, file upload, file download, interactive remote shell, and SOCKS5 proxying) and profiles each victim host on connect (hostname, username, UID, local IP, malware PID, connection timestamp) — richer telemetry than earlier BlueShell variants, which sent only an OS identifier.
BlackTech is a long-tracked, China-linked espionage actor (active since at least 2013 per MITRE ATT&CK) previously the subject of a joint CISA/NSA/FBI/Japan NPA-NISC advisory (AA23-270A, 2023-09-27) documenting its use of modified Cisco router firmware and SSH-enabled hardware backdoors to pivot between international subsidiary networks and Japanese/U.S. headquarters. This BlueShell deployment is consistent with that established playbook — abuse of trusted internal network paths and living-off-the-land/dual-use tooling — applied to a new, lightweight, open-source Linux implant rather than router firmware.
Target sectors: government administration, defense, electronics, telecoms, technology, news - media, enterprise
Target regions: japan, south korea, thailand, taiwan, united states of america
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1078, T1190, T1059.004, T1106, T1036.005, T1027, T1140, T1070.004, T1082, T1033
