BlackTech APT Deploys BlueShell Linux Backdoor Against Japanese Organizations

BlackTech has been linked to a newly examined Linux backdoor deployment against organizations in Japan, showing how a familiar remote-access tool can be reshaped for cyberespionage.

The malware gives intruders a way to run commands, move files, and route traffic after they have already entered a network, raising the risk to internal systems and sensitive data.

The attack begins after the attackers gain access and move laterally through the victim environment using SSH.

From there, they deploy a loader that launches the backdoor, a method that reflects the group’s established interest in stealthy network access, including earlier BlackTech router intrusion activity targeting corporate networks.

Analysts at IIJ Security Diary identified the malware as a Linux variant of BlueShell used during post-compromise activity by BlackTech.

IIJ Security Diary said in a report shared with Cyber Security News (CSN) that it observed three recent variants in May 2026.

BlueShell is written in Go and is based on an openly available remote-access tool, but the observed versions contain added features intended to make investigation harder.

Its use against Japanese organizations also shows that BlackTech continues to adjust its tools as defenders improve monitoring.

BlackTech APT Deploys BlueShell Linux Backdoor

The loader decodes concealed data, decompresses the backdoor, and starts it with altered process information so it can resemble a normal Linux kernel worker.

It then removes the deployed backdoor from the file system, reducing the evidence available to responders during a routine disk investigation.

This approach makes incident response more difficult because the remaining loader may also be deleted after execution.

Investigators should preserve affected systems quickly and consider file-system carving or memory forensics when expected malware files are missing, especially after suspicious SSH activity or Linux SSH credential theft.

Once active, the backdoor reads its hidden settings from environment variables and checks whether it is running on the intended host.

It can then collect basic host details, receive remote commands, transfer files, open a shell, and create a SOCKS5 proxy that can help attackers reach other resources.

Proxy-Based C2 Evasion

A notable feature of this BlueShell variant is its ability to communicate with its command-and-control server through the victim organization’s own proxy server.

Earlier versions seen before 2023 did not include this capability, while samples identified from 2024 onward have increasingly used it.

Routing traffic through a trusted internal proxy can make malicious connections appear closer to normal business activity.

Security teams should review unusual outbound proxy use, unexpected encrypted sessions, and new connections from Linux servers, while also examining patterns highlighted in SOCKS5 proxy abuse campaigns.

The malware also checks part of the command server’s digital certificate before continuing its connection, adding another layer of control over where it communicates.

Its renamed commands appear designed to slow analysis, although researchers could still infer their purpose from information left inside the Go binary.

Organizations should treat unexpected SSH movement between servers as a high-priority signal and retain endpoint, authentication, and proxy logs long enough to reconstruct attacker activity.

Monitoring advice from SSH lateral movement investigations similarly stresses that SSH artifacts and network telemetry can reveal attacker paths even after cleanup efforts.

The reported activity reinforces the need for continued vigilance around BlackTech operations targeting Japan.

Fast containment, evidence preservation, and review of proxy and SSH behavior can give defenders a better chance of finding this type of intrusion before attackers expand their access.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.