BlackTech__2021__unit42.paloaltonetworks.com-BendyBear_Novel_Chinese_Shellcode_Linked_With_Cyber_Espionage_Group_BlackTech.pdf

BendyBear is a sophisticated, >10KB x64 stage‑0 shellcode downloader attributed to the BlackTech espionage group; it uses modified RC4, per‑session keys, polymorphic and anti‑analysis techniques, registry‑based configuration and in‑memory PE loading to stealthily retrieve a stage‑2 implant from C2. The Unit 42 analysis includes protocol and cryptographic details, sample hashes and domains, comparisons to WaterBear, and mitigation guidance for detection and blocking.