A previously unknown advanced threat actor tracked as “Blackwood” has recently been discovered using a novel backdoor for adversary-in-the-middle (AitM) attacks. Blackwood has gone undetected for more than half a decade, conducting clandestine cyber-espionage operations going back to 2018. The threat actor utilizes the NSPX30 malware, having code associated with a backdoor from a 2005 campaign called “Project Wood” which was first used to target Hong Kong politicians, eventually evolving into DCM (Dark Specter) in 2008, and then in 2020 developed into NSPX30, where the first sample of the current implant was used in a campaign aligning with Chinese state interests. Blackwood is using a much more sophisticated version of the malware that’s unlike its predecessors. The latest version has a multi-stage design, targeting individuals in China, Japan, and the United Kingdom. The malware is delivered by exploiting the software update processes of popular applications like WPS Office (office suite), the Tencent QQ instant messaging platform, and the Sogou Pinyin document editor. NSPX30 primarily serves to collect information from a breached system, but its capabilities extend from data exfiltration to keylogging, evading detection, and packet interception to hide its infrastructure. Among other features, it can also steal chat logs and contact lists from a handful of apps including Tencent QQ, WeChat, Telegram, Skype, CloudChat, RaidCall, YY, and AliWangWang. The group’s advanced techniques, particularly their use of AiTM attacks to deliver malware invisibly, highlight the evolving threat landscape and the necessity for organizations to adopt comprehensive cybersecurity measures, including endpoint protection, vigilant network monitoring, and strategic network segmentation. Reach out to CTIX analysts for expert support if your organization requires assistance in bolstering its cybersecurity posture.