BlackTech__2020__Palmerworm_Espionage_Gang_Targets_the_Media_Finance_and_Other_Sectors_Symantec_Blogs.pdf

Symantec's Threat Hunter Team reports on a Palmerworm (BlackTech) espionage campaign active from August 2019 into 2020 that targeted organizations in East Asia and the U.S. using new custom backdoors (Consock, Waship, Dalwit, Nomri), dual-use tools, stolen code-signing certificates, and network reconnaissance; the report includes victim timelines, IoCs (hashes and IPs), and recommended detections.