Nation-backed Chinese hackers have been targeting Japanese companies with an emerging malware dubbed “Flagpro”. Based on the tactics of the threat group, researchers believe that this is the work of the BlackTech advanced persistent threat (APT) group. This threat group is one of the lesser-known cyberespionage groups and was first observed in the wild in mid-2017. Typically, BlackTech hackers conduct espionage operations throughout entities in Taiwan, however activity has been seen in Hong Kong and Japan regions. Last year BlackTech was noted having significant ties to the WaterBear, another Chinese-backed hacking group. Often delivered via malicious phishing email attachments, the initial stage of the Flagpro malware preforms extensive network reconnaissance on the infected target and prepares the system for the second stage malware download. Flagpro communicates back to the actor-controlled command and control (C2) server, allowing the server to send back additional malware payloads, receive system information, and issue commands on the infected system. BlackTech utilizes Flagpro to exploit targets in the defense technologies, media, and communication industries. CTIX is continuing to monitor the movements of BlackTech as well as utilization of Flagpro malware variants and will provide any additional insight accordingly.