Threat intelligence / Malware

PLEAD

[PLEAD](https://attack.mitre.org/software/S0435) is a remote access tool (RAT) and downloader used by [BlackTech](https://attack.mitre.org/groups/G0098) in targeted attacks in East Asia including Taiwan, Japan, and Hong Kong.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018) [PLEAD](https://attack.mitre.org/software/S0435) has also been referred to as [TSCookie](https://attack.mitre.org/software/S0436), though more recent reporting indicates likely separation between the two. [PLEAD](https://attack.mitre.org/software/S0435) was observed in use as early as March 2017.(Citation: JPCert TSCookie March 2018)(Citation: JPCert PLEAD Downloader June 2018)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PLEAD](https://attack.mitre.org/software/S0435) is a remote access tool (RAT) and downloader used by [BlackTech](https://attack.mitre.org/groups/G0098) in targeted attacks in East Asia including Taiwan, Japan, and Hong Kong.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018) [PLEAD](https://attack.mitre.org/software/S0435) has also been referred to as [TSCookie](https://attack.mitre.org/software/S0436), though more recent reporting indicates likely separation between the two. [PLEAD](https://attack.mitre.org/software/S0435) was observed in use as early as March 2017.(Citation: JPCert TSCookie March 2018)(Citation: JPCert PLEAD Downloader June 2018)

Labels

malware

16 recorded

Relationships

uses

Group

uses

to Application Window Discovery

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

6 external

References

mitre-attack

S0435

Trend Micro PLEAD RTLO

https://blog.trendmicro.com/trendlabs-security-intelligence/plead-targeted-attacks-against-taiwanese-government-agencies-2/

TrendMicro BlackTech June 2017

https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/

PLEAD

—

JPCert PLEAD Downloader June 2018

https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html

JPCert TSCookie March 2018

https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html