PLEAD

The PLEAD malware is a malicious software that was discovered by ESET researchers in 2019 to be utilized by the Chinese APT group known as BlackTech. The group was found to be performing Man-in-the-Middle (MitM) attacks through compromised ASUS routers and delivering the PLEAD malware through ASUS WebStorage software updates. The malware, also referred to as TSCookie, has been active since 2015 and is known for its ability to steal data from victim organizations. The threat actors deployed PLEAD hidden within legitimate-looking software updates from Asus, leveraging it to target additional systems within the environment. Several incidents related to the PLEAD malware have been reported over the years. For instance, Bowser pleaded guilty to two charges related to the malware and was sentenced to 40 months in prison and a fine of $4.5 million, later increased by $10 million. In another case, Jack Teixeira, a former airman and Pentagon leak suspect, was expected to plead guilty for his role in leaking sensitive intelligence online, which was linked to the use of PLEAD. Furthermore, two foreign nationals pleaded guilty to their participation in the LockBit Ransomware Group, which used similar tactics to those seen in the PLEAD campaign. The PLEAD malware's unique behavior, such as the capability to eavesdrop on edge networking equipment and perform DNS and HTTP hijacking, has been seldom observed. Other campaigns like ZuoRat, VPNFilter, Attor, and Cuttlefish have exhibited similar behavior. However, PLEAD stands out due to its specific design to seek out private IP connections for hijacking. This innovation represents the next generation in malware capabilities, indicating an evolving threat landscape that requires vigilant cybersecurity measures.