{
	"id": "0307f752-866e-4b9d-a639-3a1670acd5aa",
	"created_at": "2026-04-06T00:08:13.892083Z",
	"updated_at": "2026-04-10T03:32:21.304771Z",
	"deleted_at": null,
	"sha1_hash": "61e997ee4299b70e6ae2c1c484c06f7658d141a2",
	"title": "PLEAD (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 74044,
	"plain_text": "PLEAD (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 14:27:02 UTC\r\nPLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module\r\nand DRAWDOWN for the respective downloader.\r\n2020-12-24 ⋅ IronNet ⋅\r\nChina cyber attacks: the current threat landscape\r\nPLEAD TSCookie FlowCloud Lookback PLEAD PlugX Quasar RAT Winnti 2020-12-19 ⋅ Cyber And Ramen blog ⋅\r\nMike R\r\nPersistence Pays Off: A Brief Look at BlackTech’s 2020\r\nPLEAD TSCookie PLEAD 2020-09-29 ⋅ Symantec ⋅ Threat Hunter Team\r\nPalmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors\r\nKIVARS PLEAD BlackTech 2019-12-12 ⋅ FireEye ⋅ Chi-en Shen, Oleg Bondarenko\r\nCyber Threat Landscape in Japan – Revealing Threat in the Shadow\r\nCerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer\r\n(PWS) PandaBanker PLEAD POISONPLUG TrickBot BlackTech 2019-11-22 ⋅ SANS Cyber Security Summit ⋅ Rachel\r\nMullan, Sveva Vittoria Scenarelli\r\nNeed for PLEAD: BlackTech Pursuit\r\nBLUETHER PLEAD 2019-10-01 ⋅ ⋅ Macnica Networks ⋅ Macnica Networks\r\nTrends in Cyber Espionage Targeting Japan 1st Half of 2019\r\nPLEAD TSCookie Datper PLEAD 2019-09-18 ⋅ JPCERT/CC ⋅ Shusei Tomonaga\r\nMalware Used by BlackTech after Network Intrusion\r\nPLEAD 2019-08-01 ⋅ Kaspersky Labs ⋅ GReAT\r\nAPT trends report Q2 2019\r\nZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger\r\nHOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy 2019-05-30 ⋅ JPCERT/CC ⋅ Shusei\r\nTomonaga\r\nBug in Malware “TSCookie” - Fails to Read Configuration - (Update)\r\nPLEAD 2019-05-14 ⋅ ESET Research ⋅ Anton Cherepanov\r\nPlead malware distributed via MitM attacks at router level, misusing ASUS WebStorage\r\nPLEAD BlackTech 2019-04-01 ⋅ ⋅ Macnica Networks ⋅ Macnica Networks\r\nTrends in Cyber Espionage Targeting Japan 2nd Half of 2018\r\nAnel Cobalt Strike Datper PLEAD Quasar RAT RedLeaves taidoor Zebrocy 2018-11-12 ⋅ JPCERT/CC ⋅ Shusei\r\nTomonaga\r\nBug in Malware “TSCookie” - Fails to Read Configuration\r\nPLEAD 2018-07-09 ⋅ ESET Research ⋅ Anton Cherepanov\r\nCertificates stolen from Taiwanese tech‑companies misused in Plead malware campaign\r\nPLEAD BlackTech 2018-06-08 ⋅ JPCERT/CC ⋅ Shusei Tomonaga\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.plead\r\nPage 1 of 2\n\nPLEAD Downloader Used by BlackTech\r\nPLEAD 2018-03-06 ⋅ Shusei Tomonaga\r\nMalware “TSCookie”\r\nPLEAD 2018-01-10 ⋅ Freebuf ⋅ Tencent Computer Manager\r\nAnalysis of BlackTech's latest APT attack\r\nPLEAD 2017-06-22 ⋅ Trend Micro ⋅ CH Lei, Lenart Bermejo, Razor Huang\r\nFollowing the Trail of BlackTech’s Cyber Espionage Campaigns\r\nPLEAD BlackTech 2017-06-22 ⋅ Trend Micro ⋅ CH Lei, Lenart Bermejo, Razor Huang\r\nThe Trail of BlackTech’s Cyber Espionage Campaigns\r\nbifrose KIVARS PLEAD 2017-06-01 ⋅ Trend Micro ⋅ CH Lei, Lenart Bermejo, Razor Huang\r\nFollowing the Trail of BlackTech’s Cyber Espionage Campaigns\r\nPLEAD 2016-04-13 ⋅ FireEye ⋅ Daniel Regalado, Erye Hernandez, Taha Karim, Varun Jian\r\nGhosts in the Endpoint\r\nPLEAD 2014-07-02 ⋅ Trend Micro ⋅ Kervin Alintanahin, Ronnie Giagone\r\nKIVARS With Venom: Targeted Attacks Upgrade with 64-bit “Support”\r\nFakeWord KIVARS PLEAD Poison RAT Zeus\r\n[TLP:WHITE] win_plead_auto (20251219 | Detects win.plead.)\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.plead\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.plead\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
	],
	"report_names": [
		"win.plead"
	],
	"threat_actors": [
		{
			"id": "71b19e59-b5f7-4bc6-816d-194be0f02af0",
			"created_at": "2022-10-25T16:07:24.301036Z",
			"updated_at": "2026-04-10T02:00:04.928222Z",
			"deleted_at": null,
			"main_name": "Taidoor",
			"aliases": [
				"Budminer",
				"Earth Aughisky",
				"G0015"
			],
			"source_name": "ETDA:Taidoor",
			"tools": [
				"Dripion",
				"Masson",
				"Taidoor",
				"simbot"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "5a0483f5-09b3-4673-bb5a-56d41eaf91ed",
			"created_at": "2023-01-06T13:46:38.814104Z",
			"updated_at": "2026-04-10T02:00:03.110104Z",
			"deleted_at": null,
			"main_name": "MageCart",
			"aliases": [],
			"source_name": "MISPGALAXY:MageCart",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "1aead86d-0c57-4e3b-b464-a69f6de20cde",
			"created_at": "2023-01-06T13:46:38.318176Z",
			"updated_at": "2026-04-10T02:00:02.925424Z",
			"deleted_at": null,
			"main_name": "DAGGER PANDA",
			"aliases": [
				"UAT-7290",
				"Red Foxtrot",
				"IceFog",
				"RedFoxtrot",
				"Red Wendigo",
				"PLA Unit 69010"
			],
			"source_name": "MISPGALAXY:DAGGER PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "faa4a29b-254a-45bd-b412-9a1cbddbd5e3",
			"created_at": "2022-10-25T16:07:23.80111Z",
			"updated_at": "2026-04-10T02:00:04.753677Z",
			"deleted_at": null,
			"main_name": "LookBack",
			"aliases": [
				"FlowingFrog",
				"LookBack",
				"LookingFrog",
				"TA410",
				"Witchetty"
			],
			"source_name": "ETDA:LookBack",
			"tools": [
				"FlowCloud",
				"GUP Proxy Tool",
				"SodomMain",
				"SodomMain RAT",
				"SodomNormal"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c97cf0c1-7f0d-4e35-9bb9-bceaad178c3d",
			"created_at": "2023-01-06T13:46:38.760807Z",
			"updated_at": "2026-04-10T02:00:03.091254Z",
			"deleted_at": null,
			"main_name": "ZooPark",
			"aliases": [],
			"source_name": "MISPGALAXY:ZooPark",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "efa7c047-b61c-4598-96d5-e00d01dec96b",
			"created_at": "2022-10-25T16:07:23.404442Z",
			"updated_at": "2026-04-10T02:00:04.584239Z",
			"deleted_at": null,
			"main_name": "BlackTech",
			"aliases": [
				"BlackTech",
				"Canary Typhoon",
				"Circuit Panda",
				"Earth Hundun",
				"G0098",
				"Manga Taurus",
				"Operation PLEAD",
				"Operation Shrouded Crossbow",
				"Operation Waterbear",
				"Palmerworm",
				"Radio Panda",
				"Red Djinn",
				"T-APT-03",
				"TEMP.Overboard"
			],
			"source_name": "ETDA:BlackTech",
			"tools": [
				"BIFROST",
				"BUSYICE",
				"BendyBear",
				"Bluether",
				"CAPGELD",
				"DRIGO",
				"Deuterbear",
				"Flagpro",
				"GOODTIMES",
				"Gh0stTimes",
				"IconDown",
				"KIVARS",
				"LOLBAS",
				"LOLBins",
				"Linopid",
				"Living off the Land",
				"TSCookie",
				"Waterbear",
				"XBOW",
				"elf.bifrose"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2646f776-792a-4498-967b-ec0d3498fdf1",
			"created_at": "2022-10-25T15:50:23.475784Z",
			"updated_at": "2026-04-10T02:00:05.269591Z",
			"deleted_at": null,
			"main_name": "BlackTech",
			"aliases": [
				"BlackTech",
				"Palmerworm"
			],
			"source_name": "MITRE:BlackTech",
			"tools": [
				"Kivars",
				"PsExec",
				"TSCookie",
				"Flagpro",
				"Waterbear"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "50bd4a6c-7542-4bdd-8b37-ab468fc428ef",
			"created_at": "2023-01-06T13:46:38.998658Z",
			"updated_at": "2026-04-10T02:00:03.176186Z",
			"deleted_at": null,
			"main_name": "Taidoor",
			"aliases": [
				"G0015",
				"Earth Aughisky"
			],
			"source_name": "MISPGALAXY:Taidoor",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "478e9b27-39b9-49e4-a3c5-81569a767275",
			"created_at": "2022-10-25T15:50:23.417339Z",
			"updated_at": "2026-04-10T02:00:05.41593Z",
			"deleted_at": null,
			"main_name": "Taidoor",
			"aliases": [
				"Taidoor"
			],
			"source_name": "MITRE:Taidoor",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "4d5f939b-aea9-4a0e-8bff-003079a261ea",
			"created_at": "2023-01-06T13:46:39.04841Z",
			"updated_at": "2026-04-10T02:00:03.196806Z",
			"deleted_at": null,
			"main_name": "APT41",
			"aliases": [
				"WICKED PANDA",
				"BRONZE EXPORT",
				"Brass Typhoon",
				"TG-2633",
				"Leopard Typhoon",
				"G0096",
				"Grayfly",
				"BARIUM",
				"BRONZE ATLAS",
				"Red Kelpie",
				"G0044",
				"Earth Baku",
				"TA415",
				"WICKED SPIDER",
				"HOODOO",
				"Winnti",
				"Double Dragon"
			],
			"source_name": "MISPGALAXY:APT41",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "5d9dfc61-6138-497a-b9da-33885539f19c",
			"created_at": "2022-10-25T16:07:23.720008Z",
			"updated_at": "2026-04-10T02:00:04.726002Z",
			"deleted_at": null,
			"main_name": "Icefog",
			"aliases": [
				"ATK 23",
				"Dagger Panda",
				"Icefog",
				"Red Wendigo"
			],
			"source_name": "ETDA:Icefog",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"Dagger Three",
				"Fucobha",
				"Icefog",
				"Javafog",
				"POISONPLUG.SHADOW",
				"RoyalRoad",
				"ShadowPad Winnti",
				"XShellGhost"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "93edf98a-03c1-48b3-a94c-e1bddc24f0e6",
			"created_at": "2022-10-25T16:07:24.435275Z",
			"updated_at": "2026-04-10T02:00:04.988022Z",
			"deleted_at": null,
			"main_name": "ZooPark",
			"aliases": [
				"APT-C-38",
				"Cobalt Juno",
				"Saber Lion",
				"TG-2884"
			],
			"source_name": "ETDA:ZooPark",
			"tools": [
				"ZooPark"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "75024aad-424b-449a-b286-352fe9226bcb",
			"created_at": "2023-01-06T13:46:38.962724Z",
			"updated_at": "2026-04-10T02:00:03.164536Z",
			"deleted_at": null,
			"main_name": "BlackTech",
			"aliases": [
				"CIRCUIT PANDA",
				"Temp.Overboard",
				"Palmerworm",
				"G0098",
				"T-APT-03",
				"Manga Taurus",
				"Earth Hundun",
				"Mobwork",
				"HUAPI",
				"Red Djinn",
				"Canary Typhoon"
			],
			"source_name": "MISPGALAXY:BlackTech",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "3b93ef3c-2baf-429e-9ccc-fb80d0046c3b",
			"created_at": "2025-08-07T02:03:24.569066Z",
			"updated_at": "2026-04-10T02:00:03.730864Z",
			"deleted_at": null,
			"main_name": "BRONZE CANAL",
			"aliases": [
				"BlackTech",
				"CTG-6177 ",
				"Circuit Panda ",
				"Earth Hundun",
				"Palmerworm ",
				"Red Djinn",
				"Shrouded Crossbow "
			],
			"source_name": "Secureworks:BRONZE CANAL",
			"tools": [
				"Bifrose",
				"DRIGO",
				"Deuterbear",
				"Flagpro",
				"Gh0stTimes",
				"KIVARS",
				"PLEAD",
				"Spiderpig",
				"Waterbear",
				"XBOW"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "2a24d664-6a72-4b4c-9f54-1553b64c453c",
			"created_at": "2025-08-07T02:03:24.553048Z",
			"updated_at": "2026-04-10T02:00:03.787296Z",
			"deleted_at": null,
			"main_name": "BRONZE ATLAS",
			"aliases": [
				"APT41 ",
				"BARIUM ",
				"Blackfly ",
				"Brass Typhoon",
				"CTG-2633",
				"Earth Baku ",
				"GREF",
				"Group 72 ",
				"Red Kelpie ",
				"TA415 ",
				"TG-2633 ",
				"Wicked Panda ",
				"Winnti"
			],
			"source_name": "Secureworks:BRONZE ATLAS",
			"tools": [
				"Acehash",
				"CCleaner v5.33 backdoor",
				"ChinaChopper",
				"Cobalt Strike",
				"DUSTPAN",
				"Dicey MSDN",
				"Dodgebox",
				"ForkPlayground",
				"HUC Proxy Malware (Htran)"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434093,
	"ts_updated_at": 1775791941,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/61e997ee4299b70e6ae2c1c484c06f7658d141a2.pdf",
		"text": "https://archive.orkl.eu/61e997ee4299b70e6ae2c1c484c06f7658d141a2.txt",
		"img": "https://archive.orkl.eu/61e997ee4299b70e6ae2c1c484c06f7658d141a2.jpg"
	}
}