{
  "family": "korplug",
  "sample_count": 10,
  "category": "trojan",
  "description": "Backdoor:Win32/Korplug (widely known in the cybersecurity community as **PlugX**) is a highly customized, persistent Remote Access Trojan (RAT) used extensively since 2012 by numerous Chinese state-sponsored APT groups (including APT41, Mustang Panda, and APT10). PlugX is heavily utilized for cyber espionage, deep network reconnaissance, and long-term data exfiltration against government, technology, and telecommunications targets globally.<br><br><b>Understanding Korplug (PlugX)</b><br>To the victim, the infection is entirely invisible. For a threat intelligence analyst, a PlugX detection is a critical national security incident. It indicates that the organization is actively being targeted by a top-tier Chinese cyber espionage unit. PlugX is notable for its modular architecture; the core backdoor can load various plugins on the fly to perform keylogging, screen capture, SQL dumping, and lateral movement, all without dropping new files to disk.<br><br><b>Execution and DLL Side-Loading Mechanics</b><br>APT groups typically distribute PlugX via highly targeted spearphishing (`T1566.001`) or by exploiting external-facing vulnerabilities (`T1190`). PlugX is famous for popularizing the technique of **DLL Side-Loading** (`T1574.002`). The attackers drop three files: a legitimate, digitally signed executable (e.g., an old version of a Symantec or Google updater), a malicious DLL payload, and an encrypted `.dat` file containing the true PlugX shellcode. When the legitimate executable runs, it inadvertently loads the malicious DLL, which decrypts and injects the PlugX payload directly into memory (`T1055.001`). This bypasses many EDR solutions because the executing process is signed and trusted. PlugX then establishes a covert C2 channel (often custom encrypted TCP/HTTP) (`T1071.001`) to begin data exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating, long-term compromise of intellectual property and state secrets. The classic IoC is the 'Trifecta' of files dropped in a temporary or application directory: a legitimate `.exe`, a suspicious `.dll`, and a `.dat` or `.bin` file. EDR logs will show the legitimate, signed executable establishing anomalous, beaconing outbound network connections.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Korplug and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Korplug is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Korplug establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Korplug typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Korplug compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Korplug should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Korplug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Korplug frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Korplug across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Korplug by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1566.001",
    "T1071.001",
    "T1041",
    "T1574.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading (The classic PlugX technique)",
      "tactic": "Persistence"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; an active PlugX infection means a highly skilled nation-state actor is operating within the network.",
    "Assume all local credentials, browser passwords, and sensitive documents on the machine have been compromised. Enforce immediate password resets.",
    "Do not attempt a standard remediation; capture a full memory dump (RAM) and forensic disk image. The memory dump is crucial to extract the decrypted PlugX plugins.",
    "Perform a complete bare-metal wipe and reinstall of the operating system; APT actors utilize highly advanced, undocumented persistence mechanisms."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over if one PlugX instance is quarantined; these actors frequently deploy multiple, redundant backdoors.",
    "Avoid tipping off the adversary; coordinate with specialized incident response teams before taking noisy containment actions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}