Threat reportMalwareTL-2026-1803
BlackTech Deploys BlueShell Linux Backdoor Against Japanese Organizations
BlackTech Deploys BlueShell Linux Backdoor Against Japanese (TL-2026-1803) is a high-severity malware campaign, first published 2026-07-31. It is attributed to BlackTech (China) with high confidence, affects N/A (post-compromise deployment, not a software vulnerability), maps to 21 MITRE ATT&CK techniques (T1005, T1021.004, T1027), and is covered by 9 detection rules and 32 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1BlackTech
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-1803
- Threat ID
- TL-2026-1803
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- BlackTech
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, electronics, telecoms, technology, news - media, enterprise
- Target regions
- japan, south korea, thailand, taiwan, united states of america
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in BlackTech Deploys BlueShell Linux Backdoor Against Japanese
Malware and tooling: BTSDoor, BlueShell, Flagpro - S0696, Kivars - S0437, PLEAD - S0435, TSCookie, Waterbear, BlueShell command set (x0 sleep, x1 file upload, x2 file download, x3 interactive remote shell, x4 SOCKS5 proxy), PSEXEC
How BlackTech Deploys BlueShell Linux Backdoor Against Japanese works
BlackTech, a China-aligned APT group, is deploying a Linux variant of the open-source, Go-based BlueShell RAT against Japanese enterprise environments. The backdoor masquerades as a kernel worker process, self-deletes its dropper to remain memory-resident, and routes C2 traffic through the victim organization's own internal HTTP/S proxy to evade network-perimeter detection.
IIJ-SECT (Internet Initiative Japan) analysts identified three new Linux samples of the BlueShell backdoor, uploaded to VirusTotal from Indonesia and Singapore in May 2026, and attributed the activity to the China-aligned espionage group BlackTech (aka Palmerworm, Temp.Overboard, Circuit Panda, Radio Panda). BlueShell is an open-source, Go-based, cross-platform (Windows/Linux/macOS) RAT originally published on GitHub with Chinese-language documentation; the original repository has since been removed but the source persists in forks, and multiple China-nexus actors (including the unrelated Dalbit group) have independently repurposed it.
In this campaign, a purpose-built dropper is deployed to hosts BlackTech has already reached laterally, typically via SSH using stolen or weak credentials. The dropper carries an embedded payload (0x21E3BA bytes in its .data section) that it XOR-decodes with a single-byte key (0x63) and decompresses with FastLZ, writing the resulting BlueShell binary to /tmp/kthread before executing it and deleting the dropper from disk — leaving only the in-memory-resident backdoor. At runtime the process sets argv[0] to a string such as "[kworker/12:12]" to masquerade as a Linux kernel worker thread, defeating naive process-listing review. Its C2/proxy/sleep configuration is Base64- and XOR-encoded and passed via an environment variable (observed name: "wtim"), and includes the C2 host/port, a retry sleep interval (666s in the analyzed sample), a hostname gate, and internal-proxy address/port/username/password. C2 sessions run over TLS and only proceed if the presented X.509 certificate's Common Name contains one of a small allow-list of strings ("microsoft", "google", "cloudflare", "centos", "ubuntu") — a lightweight anti-sandboxing/anti-interception check rather than genuine certificate validation. The observed C2 endpoint, 48.216.210.91:443, sits in Microsoft Azure space (AS8075).
The defining evolution in this variant is proxy-aware C2 routing: rather than reaching out directly to the internet, BlueShell can pivot its C2 traffic through the victim's own authenticated internal proxy (in the analyzed sample, 10.210.20.254:3128 — a default Squid deployment, with a hardcoded credential pair test/test), making outbound C2 traffic blend in with legitimate proxied enterprise traffic and bypass perimeter egress controls that assume direct-to-internet connections are the only exfiltration path. IIJ-SECT notes this capability is absent from pre-2023 BlueShell samples and has been consistently present in samples observed from 2024 onward, indicating deliberate, ongoing tradecraft investment. The backdoor exposes a compact command set (sleep/interval control, file upload, file download, interactive remote shell, and SOCKS5 proxying) and profiles each victim host on connect (hostname, username, UID, local IP, malware PID, connection timestamp) — richer telemetry than earlier BlueShell variants, which sent only an OS identifier.
BlackTech is a long-tracked, China-linked espionage actor (active since at least 2013 per MITRE ATT&CK) previously the subject of a joint CISA/NSA/FBI/Japan NPA-NISC advisory (AA23-270A, 2023-09-27) documenting its use of modified Cisco router firmware and SSH-enabled hardware backdoors to pivot between international subsidiary networks and Japanese/U.S. headquarters. This BlueShell deployment is consistent with that established playbook — abuse of trusted internal network paths and living-off-the-land/dual-use tooling — applied to a new, lightweight, open-source Linux implant rather than router firmware.
MITRE ATT&CK techniques used in TL-2026-1803
Collection
Lateral Movement
T1021.004 SSH; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information
Discovery
T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.004 Unix Shell; T1106 Native API
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Resource Development
Affected products and versions in BlackTech Deploys BlueShell Linux Backdoor Against Japanese
- N/A (post-compromise deployment, not a software vulnerability) — Linux-based enterprise servers operating behind authenticated internal HTTP/S proxies
Vulnerable versions: N/A — deployed after SSH-based lateral access using stolen or weak credentials
Fixed in: N/A
Remediation for BlackTech Deploys BlueShell Linux Backdoor Against Japanese
Patches
- N/A — BlueShell is post-compromise tooling deployed after lateral access is obtained via credentials, not a software vulnerability; no vendor patch applies
Immediate actions
- Block/alert on outbound TLS connections to 48.216.210.91:443 (Microsoft AS8075) at network perimeter and proxy egress controls
- Hunt for processes whose argv[0]/comm matches kernel-worker patterns (e.g. [kworker/N:N]) but which have an on-disk binary, open network sockets, or a parent process other than kthreadd/PID 2 — legitimate kernel worker threads never do any of these
- Audit /tmp (and similar world-writable paths) for recently-created-then-deleted executables, orphaned inodes still held open by a running process, and files named kthread or .ICECache
- Review internal/authenticated proxy (e.g. Squid) logs for anomalous long-lived or periodic outbound sessions originating from server-tier Linux hosts, especially using default or weak proxy credentials such as test/test
- Rotate SSH credentials across the internal network and disable password authentication in favor of key-based or MFA-protected SSH access to remove the primary lateral-movement vector BlackTech uses to deploy the dropper
Workarounds
- Restrict outbound internet access from internal proxy servers to a strict allow-list of business-required destinations
- Disable or tightly ACL unused SSH paths between network segments to remove the lateral-movement precondition for dropper deployment
Longer-term hardening
- Deploy Linux EDR / eBPF-based behavioral monitoring capable of detecting argv[0] spoofing, process masquerading, and memory-resident (fileless) execution
- Segment networks to prevent SSH-based lateral movement between subsidiary/international networks and headquarters environments, consistent with BlackTech's documented domain-trust pivoting TTPs
- Deploy TLS inspection or JA3/JA4-style TLS fingerprinting to flag sessions whose certificate-validation logic (or client behavior) deviates from legitimate browser/OS trust-store behavior
- Retain endpoint, authentication, and proxy logs for an extended window sufficient to reconstruct multi-stage lateral-movement and C2 activity, per IIJ-SECT guidance
- Threat-hunt for BlackTech's broader malware portfolio (PLEAD, TSCookie, Kivars, BTSDoor, Flagpro, WaterBear) in the same environment, since BlueShell deployment indicates an active BlackTech foothold that may include other implants
Timeline of BlackTech Deploys BlueShell Linux Backdoor Against Japanese
- BlackTech (aka Palmerworm) assessed by MITRE ATT&CK and CISA to have been active since at least 2013, conducting cyber espionage against East Asian (Japan, Taiwan, Hong Kong) and U.S. government, defense, technology, and media targets.
- Earliest known BlueShell Linux variant uploaded to VirusTotal (02:51:45 UTC) from Thailand, later linked by ASEC to intrusion activity against a Thai broadcasting-sector target; source-code metadata indicates the underlying campaign was already active by this point.
- A second BlueShell variant, compiled with Go 1.18.4 and containing a source path dated 20221209, is uploaded to VirusTotal (15:47:26 UTC) from South Korea, per ASEC reporting.
- A third related BlueShell variant is uploaded to VirusTotal (05:11:53 UTC) from South Korea, completing the ASEC-documented six-month window of coordinated Korea/Thailand-targeted BlueShell activity.
- AhnLab ASEC publishes analysis of BlueShell used in APT attacks against Korean and Thai targets, documenting historical C2 infrastructure and sample hashes later used for cross-campaign malware-family correlation.
- CISA, NSA, FBI, and Japan's NPA/NISC jointly publish advisory AA23-270A detailing BlackTech's use of modified Cisco router firmware, SSH backdoors triggered by crafted TCP/UDP packets, and abuse of domain-trust relationships to pivot from international subsidiary networks into Japanese and U.S. headquarters.
- BlueShell malware family variants begin consistently implementing proxy-aware C2 communication and XOR-obfuscated environment-variable configuration delivery — an evolution IIJ-SECT confirms is absent from samples observed prior to 2023, which used Base64-only environment-variable encoding and no internal-proxy pivot capability.
- IIJ-SECT reports a 2025-observed variant of the BlackTech-associated Kivars malware family, confirming continued BlackTech operational activity against Japanese targets ahead of the BlueShell Linux findings.
- Three new Linux variants of the BlueShell backdoor, exhibiting internal-proxy C2 routing and kernel-worker process masquerading, are uploaded to VirusTotal from Indonesia and Singapore and subsequently analyzed by IIJ-SECT.
- IIJ-SECT (Internet Initiative Japan Security Coordination Team) publishes its technical analysis of the BlueShell Linux variant on the IIJ Security Diary, attributing the activity to BlackTech and detailing the dropper mechanics, environment-variable configuration scheme, and C2/proxy-pivot behavior.
- Hunt.io publishes a BlueShell malware-family profile covering its cross-platform Go implementation and adoption by multiple China-nexus actors, corroborating the open-source-tool-repurposing narrative around this campaign.
- GBHackers and Cybersecurity News publish coverage summarizing the IIJ-SECT findings, bringing the BlackTech BlueShell Linux campaign against Japanese enterprises to broader public and OSINT attention.
Sources cited for BlackTech Deploys BlueShell Linux Backdoor Against Japanese
- BlueShell Linux Backdoor Targets Japanese Enterprises
- APTグループが使用するBlueShell亜種の分析 (Analysis of a BlueShell Variant Used by an APT Group)
- People's Republic of China-Linked Cyber Actors Hide in Router Firmware (AA23-270A)
- BlackTech (G0098)
- BlueShell Backdoor: Cross-Platform Malware in Go
- BlueShell Used in APT Attacks Against Korean and Thai Targets
- BlueShell (Malware Family)
- China-linked APT BlackTech was spotted hiding in Cisco router firmware
- BlackTech APT Deploys BlueShell Linux Backdoor Against Japanese Organizations
- 2025年に確認されたBlackTechのマルウェアKivarsの亜種 (Kivars Variant Attributed to BlackTech Observed in 2025)
Detection coverage for TL-2026-1803
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1803 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.