Analyzing the Marade downloader (detected by Trend Micro as TSPY_MARADE.ZTBC) and the version of Protux (BKDR_PROTUX.ZTBC) employed by Blackgear’s latest campaigns, we found their encrypted configurations on blog and social media posts (see Figure 1).