Loading malware…
PLEAD is a backdoor associated with the China-linked espionage group BlackTech, also tracked as BRONZE CANAL, Earth Hundun, Palmerworm, and related aliases. It has been active since at least 2012 and has been used primarily in cyber espionage operations targeting East Asia, especially Taiwan, with additional activity affecting Japan and other regional organizations. Victims have included government entities, private enterprises, contractors, academia, and sectors such as technology, telecommunications, electronics, healthcare, finance, and other strategically relevant industries.
PLEAD is used as an information-theft and remote-access implant. Documented capabilities include process listing, system enumeration, remote shell access, file upload, execution of applications or commands, and deletion of files on compromised hosts. It can harvest saved credentials from major web browsers and steal saved passwords from Microsoft Outlook. Some reporting also describes modular behavior, including downloading additional functionality from command-and-control infrastructure rather than embedding all capabilities locally. Communications and data transfer have been observed using encrypted or obfuscated traffic, including RC4 and XOR-protected exchanges in different variants.
The malware has commonly been delivered through spearphishing emails, either as malicious attachments or links to cloud-hosted payloads. BlackTech operators have also used exploit-enabled delivery and infrastructure support around PLEAD, including document-based exploitation and server- or router-based staging to facilitate compromise and command and control. Campaign tradecraft has included disguised installers paired with decoy documents and right-to-left override filename masquerading. PLEAD has also appeared alongside the DRIGO exfiltration tool in broader BlackTech intrusion sets focused on theft of sensitive documents and organizational data.
In addition to Windows-focused activity, BlackTech has developed a Unix-like variant known as ELF_PLEAD. This Linux version is a 64-bit GNU/Linux backdoor that communicates over SSL and supports file operations, proxy functionality, and operator-controlled pseudo-terminal shell access. The existence of ELF_PLEAD, together with other BlackTech Linux malware, indicates sustained cross-platform development aimed at maintaining access within heterogeneous enterprise environments.
PLEAD is best characterized as a long-running espionage backdoor used for credential theft, remote access, and follow-on collection in targeted intrusions conducted by BlackTech.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We’ve also seen PLEAD use exploits for these vulnerabilities: ... CVE-2014-6352, patched by Microsoft last October, 2014 | PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
We’ve also seen PLEAD use exploits for these vulnerabilities: ... CVE-2012-0158, patched by Microsoft last April, 2012 | PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
We’ve also seen PLEAD use exploits for these vulnerabilities: CVE-2015-5119, patched by Adobe last July, 2015 ... PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach | PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server. This is another way for them to establish a new C&C or HTTP server. | PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
We’ve also seen PLEAD use exploits for these vulnerabilities: ... CVE-2017-0199, patched by Microsoft last April, 2017 | PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
HUAPI (a.k.a BlackTech/PLEAD) was definitely the most ambitious group in Taiwan. Their attacks counts around 30% of incidents we analyzed and the targeting scope includes almost all the industries we listed. The supply chain attacks we mentioned in previous paragraphs were also conducted by them.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
PLEAD actors use a router scanner tool to scan for vulnerable routers, after which the attackers will enable the router’s VPN feature then register a machine as virtual server. This virtual server will be used either as a C&C server or an HTTP server that delivers PLEAD malware to their targets.
PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server. This is another way for them to establish a new C&C or HTTP server.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The backdoor contains the ability to create a new thread and provide the operator with a pseudo-terminal (tty) shell. Shell commands are executed using “echo -e”
The malware is embedded into the resource of other executable file. The resource name is usually a popular file extension, such as AVI and BMP.
Like PLEAD, Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents. | PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename. They are mostly accompanied by decoy documents to further trick users.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Multiple layers of encryption are involved... The loader would first reconstruct the hexadecimal data into correct order in stack, and then decrypts it into encryption key. RC4 is used to perform second decryption to get the shellcode
Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
PLEAD actors use a router scanner tool to scan for vulnerable routers
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
PLEAD’s backdoor can: List drives, processes, open windows, and files
The functions visible in Figure 1 hint that the binary makes a connection to some infrastructure using SSL... The backdoor connects to an IP (168.95[.]1.1)... The backdoor described in the November 2020 post utilized the domain mx[.]msdtc.tw for command and control.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The command and command numbers that differ from the prior sample are listed below: 11C SockClient >> Client/Server proxy mode 11C TravClient
the attackers will enable the router’s VPN feature then register a machine as a virtual server. This virtual server will be used as either a C&C server or an HTTP server
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
125 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
50 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor malware/family associated in the article with the HUAPI/BlackTech intrusion set, used in broad campaigns in Taiwan including supply-chain attacks affecting multiple industries.
Listed as a tool used by the BRONZE CANAL threat profile.
Malware noted for using stolen digital signatures from Taiwan to appear legitimate and bypass trust checks.
Backdoor malware used by BlackTech for covert access to victim environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.