MALWARE FAMILY

PLEAD

Internal ID: win.plead

aliases

Last seen:Mar 17, 2026

Intelligence Profile

PLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module and DRAWDOWN for the respective downloader.

Threat Analysis

PLEAD is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html

→http://www.freebuf.com/column/159865.html

→https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html

→https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/

→https://blog.trendmicro.com/trendlabs-security-intelligence/kivars-with-venom-targeted-attacks-upgrade-with-64-bit-support/

→https://blogs.jpcert.or.jp/en/2018/11/tscookie2.html

→https://blogs.jpcert.or.jp/en/2019/05/tscookie3.html

→https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html

→https://documents.trendmicro.com/assets/appendix-following-the-trail-of-blacktechs-cyber-espionage-campaigns.pdf

→https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_2_ycy-aragorn_en.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.plead

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PLEAD