China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

A previously undocumented China-aligned threat actor has been linked to a set of adversary-in-the-middle (AitM) attacks that hijack update requests from legitimate software to deliver a sophisticated implant named NSPX30.
Slovak cybersecurity firm ESET is tracking the advanced persistent threat (APT) group under the name Blackwood. It's said to be active since at least 2018.
The NSPX30

actor advanced advanced persistent threat adversary adversary-in-the-middle aitm apt attacks china cybersecurity eset hackers hijack implant name persistent persistent threat requests software software updates spyware threat threat actor tracking under undocumented update updates