Flagpro — Malware Profile

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.

MITRE ATT&CK techniques (24)

• T1005 Data from Local System
• T1010 Application Window Discovery
• T1016 System Network Configuration Discovery
• T1018 Remote System Discovery
• T1027 Obfuscated Files or Information
• T1029 Scheduled Transfer
• T1033 System Owner/User Discovery
• T1036 Masquerading
• T1041 Exfiltration Over C2 Channel
• T1049 System Network Connections Discovery
• T1057 Process Discovery
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1069.001 Local Groups
• T1070 Indicator Removal
• T1071.001 Web Protocols
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1132.001 Standard Encoding
• T1135 Network Share Discovery
• T1204.002 Malicious File
• T1547.001 Registry Run Keys / Startup Folder
• T1566.001 Spearphishing Attachment
• T1614.001 System Language Discovery

IntelFusions coverage

• BlackTech Escalates Attacks on Japanese Organizations: Spear-Phishing, Exchange Exploitation, and a Custom Malware Factory 2026-02-16

Attributed threat actors

• BlackTech

Read the full analysis on IntelFusions