Blackwood hijacks software updates to deploy NSPX30 – Week in security with Tony Anscombe

ESET researchers disclosed that an APT named Blackwood deployed a sophisticated multistage implant, NSPX30, by performing adversary-in-the-middle hijacks of legitimate software update requests (e.g., Tencent QQ, WPS Office, Sogou Pinyin), targeting Chinese and Japanese companies and individuals in China, Japan, and the United Kingdom; the implant's lineage traces back to a small backdoor observed as early as 2005.