LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0696: Flagpro

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.[1]

EnterpriseS0696MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Flagpro matters because ATT&CK describes it as a Windows first-stage downloader associated with follow-on discovery, persistence, command-and-control, tool transfer, and possible data collection/exfiltration behaviors. For leaders, the key decision is not whether one malware name is present, but whether email, endpoint, registry, and web egress controls can expose an early foothold before it becomes broader intrusion activity.

Executive priority

Prioritize validation where business disruption would be highest: Windows endpoints receiving attachments, users with access to sensitive local or shared data, and networks where outbound web traffic is weakly monitored. The ATT&CK description notes historical use against defense, media, and communications companies in Japan, so organizations with similar sector, geography, or partner exposure should ensure incident response playbooks can rapidly answer: how did the file execute, what persistence was created, what discovery ran, and whether data moved over web-based C2.

Technical view

Treat Flagpro coverage as a Windows intrusion-chain validation exercise. ATT&CK provides no official detection text, so SOC teams should map detections to the relationships: spearphishing attachment and malicious file execution; Windows command shell, Visual Basic, and Native API execution; Registry Run Keys/Startup Folder persistence; local user/group, process, window, network, remote system, and share discovery; obfuscation/masquerading/indicator removal; web-protocol C2 with standard encoding; ingress tool transfer; local data collection; and scheduled or C2-channel exfiltration. Because several related techniques have broader platform metadata, keep this object’s implementation scope constrained to the supplied Windows malware platform unless local evidence shows otherwise.

Likely telemetry

  • Email gateway and attachment metadata, including sender, recipient, attachment type, detonation results, and user interaction where available
  • Endpoint process creation telemetry with command line, parent/child process relationships, script interpreter activity, and module/API-related signals where collected
  • Windows registry and startup folder change events, especially Run key creation or modification
  • File creation, rename, deletion, and download events that can support obfuscation, masquerading, ingress transfer, and indicator-removal review
  • Endpoint discovery evidence: user/group queries, process listings, network configuration and connection queries, remote host discovery, and network share enumeration

Detection direction

  • Validate chained analytics rather than relying on a single malware signature: attachment execution followed by script or command shell activity, discovery commands, persistence writes, and outbound web traffic is more decision-useful than any one event alone.
  • Tune discovery detections for context. Administrative tools can legitimately enumerate processes, users, network connections, and shares; raise priority when these occur from unusual parent processes, recently delivered files, uncommon users, or shortly before outbound transfers.
  • Confirm whether registry Run key and startup folder auditing is enabled on Windows endpoints; this is a common blind spot for persistence triage.
  • Review web egress visibility. Standard encoding and HTTP/S-based C2 can blend with normal traffic, so proxy/DNS logs, destination reputation, request periodicity, and endpoint-to-network correlation are important.
  • Account for sparse official detection guidance. Detection engineering should be validated through local telemetry tests and incident retrospectives, not assumed from ATT&CK mapping alone.

Mitigation priorities

  • Reduce initial execution risk through attachment filtering, safe handling controls, user reporting workflows, and restrictions on high-risk file types where operationally feasible.
  • Harden Windows endpoints by limiting unnecessary script and command interpreter use, enforcing least privilege, and monitoring or controlling startup persistence locations.
  • Strengthen egress governance: route outbound web traffic through monitored control points, restrict unnecessary direct Internet access, and retain sufficient proxy/DNS metadata for investigations.
  • Review local administrator exposure and local group membership because discovery of users and groups can help an intruder identify higher-value accounts.
  • Prepare IR runbooks that collect process trees, registry persistence, recently created files, outbound destinations, and data access evidence from affected Windows systems before evidence is lost.
Additional notes and limits

This take is based on the supplied ATT&CK S0696 object, its external NTT Security reference, and the listed relationships. The most operationally useful context comes from the relationships: Flagpro is not just a downloader label; it is mapped to behaviors spanning initial access, execution, persistence, discovery, defense evasion, command-and-control, collection, transfer, and exfiltration-related activity.

ATT&CK provides no official detection guidance for this object, no aliases in the supplied fields, and no object-level tactics. The description supports Windows as the platform and historical use by BlackTech since at least October 2020, primarily against defense, media, and communications companies in Japan; it does not by itself prove current activity, local exposure, or detection coverage in any environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Flagpro

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1132.001Standard EncodingSub-technique

Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.[1]

EnterpriseT1010Application Window Discovery

Flagpro can check the name of the window displayed on the system.[1]

EnterpriseT1029Scheduled Transfer

Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.[1]

EnterpriseT1614.001System Language DiscoverySub-technique

Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.[1]

EnterpriseT1059.005Visual BasicSub-technique

Flagpro can execute malicious VBA macros embedded in .xlsm files.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Flagpro can use `cmd.exe` to execute commands received from C2.[1]

EnterpriseT1027Obfuscated Files or Information

Flagpro has been delivered within ZIP or RAR password-protected archived files.[1]

EnterpriseT1005Data from Local System

Flagpro can collect data from a compromised host, including Windows authentication information.[1]

EnterpriseT1036Masquerading

Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.[1]

EnterpriseT1204.002Malicious FileSub-technique

Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.[1]

EnterpriseT1105Ingress Tool Transfer

Flagpro can download additional malware from the C2 server.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Flagpro has dropped an executable file to the startup directory.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Flagpro can communicate with its C2 using HTTP.[1]

EnterpriseT1018Remote System Discovery

Flagpro has been used to execute net view on a targeted system.[1]

EnterpriseT1069.001Local GroupsSub-technique

Flagpro has been used to execute the net localgroup administrators command on a targeted system.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Flagpro has exfiltrated data to the C2 server.[1]

EnterpriseT1033System Owner/User Discovery

Flagpro has been used to run the whoami command on the system.[1]

EnterpriseT1135Network Share Discovery

Flagpro has been used to execute `net view` to discover mapped network shares.[1]

EnterpriseT1016System Network Configuration Discovery

Flagpro has been used to execute the ipconfig /all command on a victim system.[1]

EnterpriseT1106Native API

Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Flagpro has been distributed via spearphishing as an email attachment.[1]

EnterpriseT1070Indicator Removal

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.[1]

EnterpriseT1049System Network Connections Discovery

Flagpro has been used to execute netstat -ano on a compromised host.[1]

EnterpriseT1057Process Discovery

Flagpro has been used to run the tasklist command on a compromised system.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0098: BlackTech

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · GroupG0098: BlackTechEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
679422ac9ec1c5e3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle679422ac9ec1…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  2. [2]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  3. [3]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  4. [4]
    mitre-attackS0696
    Open source URL
  5. [5]
    mitre-attackS0696
    Open source URL
  6. [6]
    mitre-attackS0696
    Open source URL
  7. [7]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  8. [8]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  9. [9]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  10. [10]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  11. [11]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  12. [12]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  13. [13]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  14. [14]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  15. [15]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  16. [16]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  17. [17]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  18. [18]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  19. [19]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  20. [20]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  21. [21]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  22. [22]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  23. [23]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  24. [24]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  25. [25]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  26. [26]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  27. [27]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  28. [28]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  29. [29]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  30. [30]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  31. [31]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  32. [32]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  33. [33]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  34. [34]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  35. [35]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  36. [36]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  37. [37]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  38. [38]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  39. [39]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  40. [40]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  41. [41]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  42. [42]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  43. [43]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  44. [44]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  45. [45]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  46. [46]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  47. [47]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  48. [48]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  49. [49]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  50. [50]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  51. [51]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
  52. [52]
    NTT Security Flagpro new December 2021

    Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use