Skip to content

S0069 BLACKCOFFEE

BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. 1 2

Item Value
ID S0069
Associated Names
Type MALWARE
Version 1.1
Created 31 May 2017
Last Modified 30 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell BLACKCOFFEE has the capability to create a reverse shell.1
enterprise T1083 File and Directory Discovery BLACKCOFFEE has the capability to enumerate files.1
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion BLACKCOFFEE has the capability to delete files.1
enterprise T1104 Multi-Stage Channels BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.1
enterprise T1057 Process Discovery BLACKCOFFEE has the capability to discover processes.1
enterprise T1102 Web Service -
enterprise T1102.001 Dead Drop Resolver BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.12
enterprise T1102.002 Bidirectional Communication BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.12

Groups That Use This Software

ID Name References
G0025 APT17 1
G0096 APT41 3
G0065 Leviathan 2

References

  1. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016. ↩↩↩↩↩↩↩↩↩

  2. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. ↩↩↩↩

  3. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩