# BlackTech Deploys BlueShell Linux Backdoor Against Japanese Organizations

> BlackTech, a China-aligned APT group, is deploying a Linux variant of the open-source, Go-based BlueShell RAT against Japanese enterprise environments. The backdoor masquerades as a kernel worker process, self-deletes its dropper to remain memory-resident, and routes C2 traffic through the victim organization's own internal HTTP/S proxy to evade network-perimeter detection.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1803
- **ID:** TL-2026-1803
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** BlackTech (China)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

IIJ-SECT (Internet Initiative Japan) analysts identified three new Linux samples of the BlueShell backdoor, uploaded to VirusTotal from Indonesia and Singapore in May 2026, and attributed the activity to the China-aligned espionage group BlackTech (aka Palmerworm, Temp.Overboard, Circuit Panda, Radio Panda). BlueShell is an open-source, Go-based, cross-platform (Windows/Linux/macOS) RAT originally published on GitHub with Chinese-language documentation; the original repository has since been removed but the source persists in forks, and multiple China-nexus actors (including the unrelated Dalbit group) have independently repurposed it.

In this campaign, a purpose-built dropper is deployed to hosts BlackTech has already reached laterally, typically via SSH using stolen or weak credentials. The dropper carries an embedded payload (0x21E3BA bytes in its .data section) that it XOR-decodes with a single-byte key (0x63) and decompresses with FastLZ, writing the resulting BlueShell binary to /tmp/kthread before executing it and deleting the dropper from disk — leaving only the in-memory-resident backdoor. At runtime the process sets argv[0] to a string such as "[kworker/12:12]" to masquerade as a Linux kernel worker thread, defeating naive process-listing review. Its C2/proxy/sleep configuration is Base64- and XOR-encoded and passed via an environment variable (observed name: "wtim"), and includes the C2 host/port, a retry sleep interval (666s in the analyzed sample), a hostname gate, and internal-proxy address/port/username/password. C2 sessions run over TLS and only proceed if the presented X.509 certificate's Common Name contains one of a small allow-list of strings ("microsoft", "google", "cloudflare", "centos", "ubuntu") — a lightweight anti-sandboxing/anti-interception check rather than genuine certificate validation. The observed C2 endpoint, 48.216.210.91:443, sits in Microsoft Azure space (AS8075).

The defining evolution in this variant is proxy-aware C2 routing: rather than reaching out directly to the internet, BlueShell can pivot its C2 traffic through the victim's own authenticated internal proxy (in the analyzed sample, 10.210.20.254:3128 — a default Squid deployment, with a hardcoded credential pair test/test), making outbound C2 traffic blend in with legitimate proxied enterprise traffic and bypass perimeter egress controls that assume direct-to-internet connections are the only exfiltration path. IIJ-SECT notes this capability is absent from pre-2023 BlueShell samples and has been consistently present in samples observed from 2024 onward, indicating deliberate, ongoing tradecraft investment. The backdoor exposes a compact command set (sleep/interval control, file upload, file download, interactive remote shell, and SOCKS5 proxying) and profiles each victim host on connect (hostname, username, UID, local IP, malware PID, connection timestamp) — richer telemetry than earlier BlueShell variants, which sent only an OS identifier.

BlackTech is a long-tracked, China-linked espionage actor (active since at least 2013 per MITRE ATT&CK) previously the subject of a joint CISA/NSA/FBI/Japan NPA-NISC advisory (AA23-270A, 2023-09-27) documenting its use of modified Cisco router firmware and SSH-enabled hardware backdoors to pivot between international subsidiary networks and Japanese/U.S. headquarters. This BlueShell deployment is consistent with that established playbook — abuse of trusted internal network paths and living-off-the-land/dual-use tooling — applied to a new, lightweight, open-source Linux implant rather than router firmware.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1106 Native API
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1021.004 SSH
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1090.001 Internal Proxy
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel
- T1588.002 Tool

## Sources

- [BlueShell Linux Backdoor Targets Japanese Enterprises](https://gbhackers.com/blueshell-linux-backdoor/)
- [APTグループが使用するBlueShell亜種の分析 (Analysis of a BlueShell Variant Used by an APT Group)](https://sect.iij.ad.jp/blog/2026/07/blueshell-variant-deployed-by-apt-group/)
- [People's Republic of China-Linked Cyber Actors Hide in Router Firmware (AA23-270A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a)
- [BlackTech (G0098)](https://attack.mitre.org/groups/G0098/)
- [BlueShell Backdoor: Cross-Platform Malware in Go](https://hunt.io/malware-families/blueshell-backdoor)
- [BlueShell Used in APT Attacks Against Korean and Thai Targets](https://asec.ahnlab.com/en/56941/)
- [BlueShell (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell)
- [China-linked APT BlackTech was spotted hiding in Cisco router firmware](https://securityaffairs.com/151587/apt/blacktech-backdoor-cisco-router-firmware.html)
- [BlackTech APT Deploys BlueShell Linux Backdoor Against Japanese Organizations](https://cybersecuritynews.com/blacktech-apt-deploys-blueshell-linux-backdoor/)
- [2025年に確認されたBlackTechのマルウェアKivarsの亜種 (Kivars Variant Attributed to BlackTech Observed in 2025)](https://sect.iij.ad.jp/blog/2025/10/blacktech-malware-kivars-2025/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1803