BlackTech__2021__EN-BlackTech_2021.pdf

NTT Security Holdings (Japan SOC) presents a 2021-focused analysis of BlackTech APT activity: describing spear-phishing and server-exploit initial vectors, in-depth technical analyses of multiple malware families (Flagpro, SelfMake, HeavyROT, Spider RAT, BTSDoor, Gh0stTimes, TSCookie, IamDown, ELF variants, etc.), communications and encryption methods, persistence and lateral-movement behaviours, and an Appendix of IoCs (SHA256 hashes, URLs, mutexes, file paths). The report includes TTPs, exploitation observations (including Exchange-related server exploits), cross-platform samples, and mitigation recommendations for detection and hardening.