One of the methods PLEAD operators use to distribute their malware PLEAD’s backdoor can:  Harvest saved credentials from browsers and email clients like Outlook List drives, processes, open windows, and files Open remote Shell Upload target file Execute applications via ShellExecute API Delete target file  PLEAD also uses the document-targeting exfiltration tool DRIGO, which mainly searches the infected machine for documents.