{
  "family": "plead",
  "sample_count": 2,
  "category": "trojan",
  "description": "Backdoor:Win32/Plead is a custom, highly evasive remote access trojan (RAT) heavily utilized by the state-sponsored cyber-espionage group BlackTech (also known as APT3, Bronze Butler, or Palmerworm). The Plead backdoor is primarily deployed in targeted attacks against technology, electronics, and government organizations in East Asia (particularly Taiwan and Japan). Its core function is to establish deep persistence, evade detection, and facilitate the long-term theft of intellectual property and sensitive corporate data (`T1059`).<br><br><b>Understanding Plead (APT Espionage Backdoor)</b><br>To an end-user, the system operates completely normally. For a threat hunter or incident responder, discovering Plead indicates a severe, targeted breach by a highly capable nation-state adversary. BlackTech operators are known for their operational security and their ability to dwell within a network for months or years undetected, continually exfiltrating data.<br><br><b>Execution and Evasion Strategies</b><br>Plead is typically deployed after initial access is gained via spear-phishing or the exploitation of public-facing infrastructure (like vulnerable VPN appliances or routers). The backdoor is known for its multi-stage loading process, often employing DLL side-loading (`T1574.002`)—hijacking legitimate, signed executables (like antivirus components or common software updaters) to load the malicious Plead DLL into memory. This severely hampers detection by standard AV. Once active, Plead communicates with its C2 infrastructure using custom, encrypted protocols, often disguising its traffic as normal HTTP or DNS requests. It provides the operators with full control: the ability to execute shell commands, upload/download files, dump credentials, and move laterally.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the catastrophic, long-term loss of intellectual property and strategic secrets. Host-based IoCs often involve discovering legitimate executables executing from unusual directories (e.g., `%AppData%`) alongside an unsigned, maliciously crafted DLL sharing the name of a required legitimate library. EDR may flag anomalous process injection (`T1055`) originating from these 'legitimate' processes. Network IoCs require deep packet inspection (DPI) to identify the custom encryption routines or beaconing patterns of the Plead C2 traffic.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1041",
    "T1574.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading (Core evasion technique)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter (Providing backdoor shell access)",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hiding within legitimate processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Stealing intellectual property)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint and assume the entire domain is compromised; engage a specialized Incident Response (IR) firm.",
    "Perform a comprehensive enterprise-wide hunt for DLL side-loading activity and anomalous child processes spawning from legitimate applications.",
    "Initiate a full credential reset for the entire organization (krbtgt reset, all user passwords, all service accounts).",
    "Deploy aggressive EDR monitoring and begin hunting for lateral movement artifacts (e.g., unauthorized PsExec or WMI usage)."
  ],
  "what_to_avoid": [
    "Do not attempt to remediate a BlackTech/Plead infection by simply deleting the malicious DLL; the actors likely have secondary backdoors deployed.",
    "Avoid communicating about the incident on the compromised corporate network; assume the attackers are monitoring emails and chat."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}