China-Linked Blackwood APT Deploys Advanced NSPX30 Backdoor in Cyberespionage

ESET researchers identified a China-aligned APT dubbed Blackwood using a sophisticated, multistage backdoor called NSPX30—evolving from samples dating to 2005—to conduct targeted cyberespionage in China, Japan, and the UK; NSPX30 leverages AiTM interception of unencrypted software update traffic (e.g., Tencent QQ, Sogou Pinyin, WPS Office) to establish covert channels, steal data (keystrokes, screenshots, system/network info), deploy modular plugins, and persist or re-compromise victims.