GINC-APT-0078 · State

Blackgear

Also Comnie, Topgear.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Motivation
Information theft and espionage
Seen
2016
Status
Dormant
Sources
9 sources carry it
Identifier
GINC-APT-0078 · blackgear

What it is

BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released covering this campaign, which used the ELIRKS backdoor when it was first discovered in 2012. It is known for using blogs and microblogging services to hide the location of its actual command-and-control (C&C) servers. This allows an attacker to change the C&C server used quickly by changing the information in these posts. Like most campaigns, BLACKGEAR has evolved over time. Our research indicates that it has started targeting Japanese users. Two things led us to this conclusion: first, the fake documents that are used as part of its infection routines are now in Japanese. Secondly, it is now using blogging sites and microblogging services based in Japan for its C&C activity.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
Comnie, Topgear

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Japan, South Korea, Taiwan

Tools

The tools and malware families the sources tie to it.

  • BLACKCOFFEE
  • Backdoor.Oldrea
  • BlackEnergy
  • BlackHole
  • BlackNix
  • Blackshades
  • Comnie
  • Eliriks
  • Elirks
  • Protux

Sources