Blackwood hijacks software updates to deploy NSPX30 – Week in security with Tony Anscombe

This week, ESET researchers released their findings about an attack where a previously unknown threat actor deployed a sophisticated multistage implant, which ESET named NSPX30, through adversary-in-the-middle (AitM) attacks hijacking update requests from legitimate software such as Tencent QQ, WPS Office, and Sogou Pinyin.

Blackwood, the name given to the APT group by ESET, used the implant in targeted attacks against Chinese and Japanese companies, as well as against individuals in China, Japan, and the United Kingdom. The evolution of …

actor adversary adversary-in-the-middle aitm attack attacks blackwood deploy eset findings hijacking implant nspx30 office requests researchers security software software updates sogou tencent threat threat actor update updates week week in security