Blackwood hackers hijack WPS Office update to install malware

Blackwood is a previously untracked, likely Chinese-aligned APT that has used the NSPX30 multistage implant since at least 2018 to conduct cyberespionage against organizations and individuals in China, Japan, and the UK. NSPX30 evolved from a 2005 backdoor lineage, features extensive data-collection and evasion capabilities, and is delivered by adversary-in-the-middle interception of unencrypted software update traffic (e.g., WPS Office, Tencent QQ, Sogou Pinyin); ESET provides technical analysis and IOCs to help defenders detect and mitigate the campaign.