Loading malware…
DRIGO is a data-theft utility used in BlackTech cyber-espionage operations, particularly alongside the PLEAD intrusion set. It is associated with long-running campaigns targeting organizations in East Asia, especially Taiwan, with victims including government agencies and private-sector entities. Its primary role is post-compromise collection and exfiltration of documents from infected systems.
DRIGO is used after initial access has been established, commonly in intrusions where PLEAD serves as the backdoor. It searches compromised machines for document files and transfers stolen data to attacker-controlled cloud accounts. Observed variants include a Google Drive uploader used to place exfiltrated files into remote storage and a mailer variant that sends stolen information through Gmail SMTP using token-based authentication. Its network activity is designed to blend with legitimate Google service traffic over HTTPS, supporting covert exfiltration.
The malware has been linked to spearphishing-based espionage activity in which lures and decoy documents are used to infect targets, after which PLEAD and related tooling provide remote access and DRIGO handles document theft. Shared infrastructure and operational overlap tie DRIGO to the broader BlackTech ecosystem, which also includes PLEAD, BIFROSE, KIVARS, XBOW, and Waterbear. The operational objective of these campaigns has been the theft of sensitive documents, including government, defense, budgetary, foreign-affairs, contract, and internal administrative materials.
DRIGO is best characterized as an exfiltration-focused component within a larger espionage toolchain rather than a full-featured standalone access platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
PLEAD’s toolset includes the self-named PLEAD backdoor and the DRIGO exfiltration tool.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
GSMTP Mailer – Makes use of Gmail SMTP services to exfiltrate information.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a tool used by the BRONZE CANAL threat profile.
A document-focused exfiltration tool that searches infected machines for documents and uploads stolen files to attacker-controlled Google Drive accounts using refresh tokens tied to Gmail accounts.
A Golang-based data theft tool used for exfiltration through Google services. Variants include a Google Drive uploader and a Gmail SMTP mailer that use OAuth refresh/access tokens to upload stolen documents or send exfiltrated data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.