HOMETHREATSBLACKCOFFEE
APT / THREAT GROUP

BLACKCOFFEE

5
aliases
Last seen:Mar 17, 2026

Intelligence Profile

a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal.

Threat Analysis

BLACKCOFFEE is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://malware-log.hatenablog.com/entry/2015/05/18/000000_1
→http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf
→https://attack.mitre.org/groups/G0001/
→https://attack.mitre.org/groups/G0025/
→https://attack.mitre.org/groups/G0096

Quick Facts

TypeAPT / Threat Group
Aliases5

Also Known As

BLACKCOFFEEPNGRATgresimZoxPNGwin.blackcoffee

External Intelligence

Malpedia: win.blackcoffee

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search BLACKCOFFEE