MITRE ATT&CKsoftware (malware)
S0435 PLEAD
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.0
- Created
- 2020-05-06
Description
PLEAD is a remote access tool (RAT) and downloader used by BlackTech in targeted attacks in East Asia including Taiwan, Japan, and Hong Kong. PLEAD has also been referred to as TSCookie, though more recent reporting indicates likely separation between the two. PLEAD was observed in use as early as March 2017.
Related
Uses · MITRE ATT&CK (15)
- T1573.001 Symmetric Cryptography sub-technique
- T1001.001 Junk Data sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1555 Credentials from Password Stores technique
- T1070.004 File Deletion sub-technique
- T1010 Application Window Discovery technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0098 BlackTech group
References
- https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/ Trend Micro PLEAD RTLO
- https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/ TrendMicro BlackTech June 2017
- https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html JPCert PLEAD Downloader June 2018
- https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html JPCert TSCookie March 2018