Blackwood hijacks software updates to deploy NSPX30 – Week in security with Tony Anscombe

The previously unknown threat actor used the implant to target Chinese and Japanese companies, as well as individuals in China, Japan, and the UK

Editor

26 Jan 2024

This week, ESET researchers released their findings about an attack where a previously unknown threat actor deployed a sophisticated multistage implant, which ESET named NSPX30, through adversary-in-the-middle (AitM) attacks hijacking update requests from legitimate software such as Tencent QQ, WPS Office, and Sogou Pinyin.

Blackwood, the name given to the APT group by ESET, used the implant in targeted attacks against Chinese and Japanese companies, as well as against individuals in China, Japan, and the United Kingdom. The evolution of NSPX30 was traced to a small backdoor all the way back to 2005.

What kinds of capabilities does NSPX30 have and what components exactly is this multistage implant made up of? Find out in the video and also make sure to read about the attack and its mechanics in this blogpost.