TSCookie

MITRE ATT&CK: S0436 View on attack.mitre.org

Aliases: TSCookie

Malware type
rat
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:55:43

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:jp

Context

TSCookie is a remote access tool (RAT) that has been used by BlackTech in campaigns against Japanese targets.. TSCookie has been referred to as PLEAD though more recent reporting indicates a separation between the two.

Detection coverage

  • 1 YARA rules
  • 239 Sigma rules

Malware & tools used

  • Windows Command Shell (attack-pattern)
  • Process Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)
  • Web Protocols (attack-pattern)
  • Process Injection (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Proxy (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Malicious Link (attack-pattern)

Used by threat actors

Detection rules

  • CAPE_Tscookie (yara-rule)

Reports & references

  • slideshare.net — Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko (report)
  • intezer.com — Top Linux Cloud Threats Of 2020 (report)
  • ironnet.com — China Cyber Attacks The Current Threat Landscape (report)
  • jp.security.ntt — En Blacktech 2021 (report)
  • Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
  • macnica.net — Mpressioncss Ta Report 2019 2 Nopw (report)
  • cyberandramen.net — Blacktech Doesnt Miss A Step A Quick Analysis Of A Busy 2020 (report)
  • malpedia.caad.fkie.fraunhofer.de — Elf.Tscookie (report)
  • jsac.jpcert.or.jp — Jsac2020 0 Jpcert En (report)
  • twitter.com — 1382054011264700416 (report)
  • macnica.net — Mpressioncss Ta Report 2019 4 En (report)
  • blogs.jpcert.or.jp — Elf Tscookie (report)
  • macnica.net — Mpressioncss Ta Report 2019 4 (report)
  • blogs.jpcert.or.jp — Tscookie Loader (report)
  • blogs.jpcert.or.jp — Malware Tscooki 7Aa0 (report)
  • MITRE ATT&CK — S0436 (report)

External references