BlueShell Stalks Linux in Japan

Article by Nacata Security, 31/07/2026

Did you know Chinese hackers have been infiltrating Japanese companies for years without being detected?

BlackTech, the China-aligned APT, has just unveiled a new silent weapon.

This group has been operating in the shadows for years, slipping into Japanese corporate networks with techniques that evolve each season to leave no trace.

They have now gone a step further: they adopted BlueShell, an open-source RAT documented in Chinese, adapted to attack Japanese corporate Linux servers.

The malware enters, acts, and vanishes from disk without a trace.

The dropper arrives via SSH using stolen credentials. It decodes the payload with XOR, decompresses it, and writes it as /tmp/kthread. It then executes it and immediately deletes the file from disk. What remains is only an in-memory image, invisible to conventional forensic analysis. The process disguises itself as a kernel worker with names like [kworker/12:12], blending in with legitimate system processes.

By the time you look for the file, it no longer exists.

IIJ Security researchers confirm that the dropper also removes itself after execution, forcing incident response teams to rely on memory forensics to recover the payload. The malware reads its configuration from environment variables, decodes it in Base64 and then with XOR, extracting parameters such as the C2 server IP, sleep intervals, and internal proxy settings.

Malicious traffic hides behind Microsoft Azure IPs.

To communicate with its command-and-control server, the backdoor establishes a TLS session and verifies the Common Name field of the X.509 certificate. It only connects if that field contains words such as microsoft, google, or cloudflare. In this way, malicious traffic blends in with legitimate connections to cloud services, bypassing corporate egress controls.

BlackTech does not improvise: it learns and refines.

Samples predating 2023 lacked C2 proxying and encrypted configuration. Those from 2024 onward implement them consistently. That is no coincidence: it is a team that iterates on its own code with real operational experience.

The internal proxy becomes an accomplice.

One of the most revealing details is that the variant routes traffic to the command-and-control server through the victim organization’s own internal proxy. Researchers found configurations pointing to port 3128, the default port for Squid. BlackTech does not attempt to bypass network controls: it uses them to its advantage, making its traffic appear as just another corporate connection.

The backdoor also profiles each compromised machine in detail.

Rather than sending only an operating system identifier, the variant exfiltrates the hostname, username, UID, local IP, and connection timestamps. This gives the attacker a precise inventory of compromised assets, facilitating session management and target prioritization within the network.

BlueShell is not exclusive to BlackTech, but they perfect it.

This Go-written RAT has been used by other China-linked actors against targets in South Korea and Thailand. BlackTech took it as a foundation and added evasion layers that did not exist in the original code.

Open-source code becomes an advanced weapon.

The fact that an APT group adopts a GitHub project with Chinese-language documentation and transforms it into a backdoor with certificate evasion, proxy-awareness, and encrypted configuration says a great deal about how state-sponsored actors operate today. They take what exists, adapt it, and deploy it with surgical precision.

Japan is squarely in the crosshairs.

Japanese companies that rely on Linux servers and HTTP proxies are the primary target. Monitoring ephemeral binaries in /tmp and unusual connections to cloud IPs is now urgent.

Would your organization be able to detect an intruder who has already erased their tracks?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime