--- title: Chinese Cyberespionage Group Blackwood Exploits Software... description: A Chinese APT group named Blackwood has been operating undetected for over five years, using software updates to deliver a sophisticated backdoor called... canonical: https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chinese Cyberespionage Group Blackwood Exploits Software Updates to Distribute NSPX30 Spyware | daily.dev og:description: A Chinese APT group named Blackwood has been operating undetected for over five years, using software updates to deliver a sophisticated backdoor called... og:url: https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm og:image: https://api.daily.dev/og/posts/PJYgmMFZM.png og:image:alt: Chinese Cyberespionage Group Blackwood Exploits Software Updates to Distribute NSPX30 Spyware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chinese Cyberespionage Group Blackwood Exploits Software Updates to Distribute NSPX30 Spyware **[Collections](https://daily.dev/sources/collections)** · 1 min read · 1 upvotes · 0 comments ## Summary A Chinese APT group named Blackwood has been operating undetected for over five years, using software updates to deliver a sophisticated backdoor called NSPX30. The attacks primarily target Chinese and Japanese companies and individuals, highlighting the importance of security measures to detect and prevent such attacks. ## Content A newly identified Chinese advanced persistent threat (APT) group named Blackwood has been discovered after operating undetected for over five years. The group has been found to use software updates as a delivery mechanism to implant a sophisticated backdoor called NSPX30. The attacks primarily target Chinese and Japanese companies and individuals. The NSPX30 implant consists of multiple components, including a dropper, an installer, loaders, an orchestrator, and a backdoor. What sets Blackwood apart is their ability to hide their command-and-control infrastructure using network implants. Unlike typical attacks, they inject their backdoor into legitimate software updates, allowing them to remain elusive. This discovery sheds light on the increasingly sophisticated tactics used by Chinese cyberespionage groups and highlights the importance of security measures to detect and prevent such attacks. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chinese Cyberespionage Group Blackwood Exploits Software Updates to Distribute NSPX30 Spyware","url":"https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm"},"datePublished":"2024-01-26T12:04:47.726Z","dateModified":"2024-01-26T21:05:42.928Z","description":"A Chinese APT group named Blackwood has been operating undetected for over five years, using software updates to deliver a sophisticated backdoor called...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48561c5b872f4beb9cfc1a555b2e353f?_a=AQAEufR","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48561c5b872f4beb9cfc1a555b2e353f?_a=AQAEufR","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chinese-cyberespionage-group-blackwood-exploits-software-updates-to-distribute-nspx30-spyware-pjygmmfzm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Chinese Cyberespionage Group Blackwood Exploits Software Updates to Distribute NSPX30 Spyware"}]} ```