MALWARE FAMILY

BLACKCOFFEE

Internal ID: win.blackcoffee

aliases

Last seen:Mar 17, 2026

Intelligence Profile

a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal.

Threat Analysis

BLACKCOFFEE is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://malware-log.hatenablog.com/entry/2015/05/18/000000_1

→http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf

→https://attack.mitre.org/groups/G0001/

→https://attack.mitre.org/groups/G0025/

→https://attack.mitre.org/groups/G0096

→https://attack.mitre.org/software/S0069/

→https://intrusiontruth.wordpress.com/2019/07/24/apt17-is-run-by-the-jinan-bureau-of-the-chinese-ministry-of-state-security/

→https://nao-sec.org/2020/01/an-overhead-view-of-the-royal-road.html

→https://web.archive.org/web/20150420064803/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf

→https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.blackcoffee

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BLACKCOFFEE