TSCookie — Malware Profile

TSCookie is a remote access tool (RAT) that has been used by BlackTech in campaigns against Japanese targets.. TSCookie has been referred to as PLEAD though more recent reporting indicates a separation between the two.

MITRE ATT&CK techniques (13)

• T1016 System Network Configuration Discovery
• T1055 Process Injection
• T1057 Process Discovery
• T1059.003 Windows Command Shell
• T1071.001 Web Protocols
• T1083 File and Directory Discovery
• T1090 Proxy
• T1095 Non-Application Layer Protocol
• T1105 Ingress Tool Transfer
• T1140 Deobfuscate/Decode Files or Information
• T1204.001 Malicious Link
• T1555.003 Credentials from Web Browsers
• T1573.001 Symmetric Cryptography

IntelFusions coverage

• BlackTech Escalates Attacks on Japanese Organizations: Spear-Phishing, Exchange Exploitation, and a Custom Malware Factory 2026-02-16

Attributed threat actors

• BlackTech

Read the full analysis on IntelFusions