China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

A previously undocumented China-aligned APT tracked as Blackwood is conducting adversary-in-the-middle (AitM) attacks that hijack unencrypted software update requests for legitimate applications (e.g., Tencent QQ, WPS Office, Sogou Pinyin) to deliver a multistage implant called NSPX30. NSPX30 is a sophisticated framework (dropper, installers, loaders, orchestrator, backdoor and plugins) that leverages packet interception, DLL side‑loading, network implants, passive UDP listeners and DNS-like exfiltration to hide infrastructure and evade Chinese anti‑malware allowlisting; observed targets include manufacturing, trading and engineering organizations and individuals in China, Japan and the U.K.