PLEAD (Windows)

Aliases: DRAWDOWN, GOODTIMES, Linopid

First seen
2012-01-01 00:00:00
Malware type
rat, downloader
Family
Malware family
Profile updated
2026-07-07 12:55:40

Targeted industries: government-and-public-sector financial-services technology-and-telecommunications

Targeted regions: country_code:tw country_code:jp country_code:hk

Context

PLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module and DRAWDOWN for the respective downloader.

Reports & references

  • Trend Micro — Following Trail Blacktech Cyber Espionage Campaigns (report)
  • ESET — Certificates Stolen Taiwanese Tech Companies Plead Malware Campaign (report)
  • ESET — Plead Malware Mitm Asus Webstorage (report)
  • slideshare.net — Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko (report)
  • Broadcom/Symantec — Palmerworm Blacktech Espionage Apt (report)
  • Kaspersky — 91897 (report)
  • ironnet.com — China Cyber Attacks The Current Threat Landscape (report)
  • macnica.net — Mpressioncss Ta Report 2019 2 Nopw (report)
  • cyberandramen.net — Blacktech Doesnt Miss A Step A Quick Analysis Of A Busy 2020 (report)
  • macnica.net — Mpressioncss Ta Report 2019 (report)
  • Trend Micro — Following Trail Blacktech Cyber Espionage Campaigns (report)
  • web.archive.org — Summit Archive 1574947724 (report)
  • sans.org — Summit Archive 1574947724 (report)
  • Trend Micro — Kivars With Venom Targeted Attacks Upgrade With 64 Bit Support (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Plead (report)
  • blogs.jpcert.or.jp — Tscookie3 (report)
  • freebuf.com — 159865 (report)
  • blog.jpcert.or.jp — Malware Tscooki 7Aa0 (report)
  • blogs.jpcert.or.jp — Tscookie Loader (report)
  • Trend Micro — Appendix Following The Trail Of Blacktechs Cyber Espionage Campaigns (report)
  • blog.jpcert.or.jp — Plead Downloader Used By Blacktech (report)
  • jsac.jpcert.or.jp — Jsac2020 2 Ycy Aragorn En (report)
  • blogs.jpcert.or.jp — Tscookie2 (report)
  • Mandiant — Ghosts In The Endpoi (report)

External references