S0435 PLEAD

malwareEnterprise

platformsWindows

also known asPLEAD

PLEAD is a remote access tool (RAT) and downloader used by BlackTech in targeted attacks in East Asia including Taiwan, Japan, and Hong Kong. PLEAD has also been referred to as TSCookie, though more recent reporting indicates likely separation between the two. PLEAD was observed in use as early as March 2017.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1001.001Junk Data
T1010Application Window Discovery
T1057Process Discovery
T1059.003Windows Command Shell
T1070.004File Deletion
T1071.001Web Protocols
T1083File and Directory Discovery
T1090Proxy
T1105Ingress Tool Transfer
T1106Native API
T1204.001Malicious Link
T1204.002Malicious File
T1555Credentials from Password Stores
T1555.003Credentials from Web Browsers
T1573.001Symmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0098BlackTech

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan