{ "family": "plugx", "sample_count": 8, "category": "rat", "description": "PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in 2012. Developed as a successor to legacy Chinese espionage tools like Gh0st RAT and Poison Ivy, PlugX has served as the flagship post-exploitation framework for numerous Chinese state-sponsored advanced persistent threat (APT) groups, including Mustang Panda (Bronze President / HoneyMyte), APT41 (Barium / Winnti), APT26, and APT10 (Stone Panda).\n\nPlugX is renowned for popularizing the 'triad' technique of DLL side-loading: threat actors pair a legitimate, cryptographically signed third-party executable (such as legitimate binaries from McAfee, Kaspersky, Symantec, or Microsoft) with a malicious proxy DLL and an encrypted payload blob (.dat or .bin). When the trusted binary executes, Windows automatically loads the attacker's DLL, which decrypts and injects the PlugX shellcode directly into memory, evading traditional endpoint file-scanning defenses.\n\nIn 2024, French cybersecurity firm Sekoia, in coordination with the French National Police (DGGN) and Europol, spearheaded a monumental international cleanup operation: researchers sinkholed the master C2 server commanding a self-propagating USB-worm variant of PlugX (Sogu), sending benign disinfection commands that disarmed over 3 million infected hosts across 100+ countries worldwide.", "cta": "Published by the SystemHelpdesk team.", "aliases": [ "PlugX", "Korplug", "Sogu", "Trojan.PlugX", "Win32/PlugX", "Backdoor.PlugX" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is PlugX / Korplug?", "acceptedAnswer": { "@type": "Answer", "text": "PlugX is a modular Remote Access Trojan heavily used by Chinese state-sponsored APT groups since 2012 for espionage, credential theft, and network reconnaissance." } }, { "@type": "Question", "name": "How does PlugX use DLL side-loading?", "acceptedAnswer": { "@type": "Answer", "text": "PlugX uses a 'triad' structure: a legitimate signed software executable loads a malicious companion DLL, which decrypts and injects the PlugX payload directly into memory without file-based detection." } }, { "@type": "Question", "name": "What was the 2024 global PlugX disinfection operation?", "acceptedAnswer": { "@type": "Answer", "text": "In 2024, French security firm Sekoia and Europol seized PlugX C2 infrastructure and sent self-deleting commands that safely cleaned over 3 million USB-infected devices worldwide." } }, { "@type": "Question", "name": "Which threat groups deploy PlugX?", "acceptedAnswer": { "@type": "Answer", "text": "Major threat actors include Mustang Panda (Bronze President), APT41 (Winnti), APT10, and APT26, targeting government, defense, and telecommunications sectors." } }, { "@type": "Question", "name": "How can defenders identify PlugX DLL side-loading?", "acceptedAnswer": { "@type": "Answer", "text": "Monitor for signed binaries loading DLLs from non-standard user directories, inspect process memory for decrypted PE headers, and scan external USB media for unauthorized LNK shortcut files." } } ], "faq_count": 5, "mitre_attack": [ "T1574.002", "T1055", "T1091", "T1071.001", "T1056.001", "T1543.003" ], "cisa_advisory": null, "last_updated": "2026-06-09", "mitre_attack_detail": [ { "id": "T1574.002", "name": "Hijack Execution Flow: DLL Side-Loading (Core evasion technique)", "tactic": "Defense Evasion" }, { "id": "T1055", "name": "Process Injection (Injecting the RAT into svchost.exe)", "tactic": "Defense Evasion" }, { "id": "T1071.001", "name": "Application Layer Protocol: Web Protocols (Encrypted C2 communication)", "tactic": "Command and Control" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel (Stealing intellectual property)", "tactic": "Exfiltration" } ], "containment_steps": [ "Instantly isolate the endpoint, but assume the adversary is already established elsewhere in the network; PlugX is an APT tool.", "Capture a full forensic memory dump (RAM) before shutting down the machine, as the active PlugX payload and its plugins reside entirely in memory.", "Perform a massive enterprise-wide hunt for the specific legitimate executable (the side-loading host) and the malicious DLL.", "Enforce immediate password resets for all accounts associated with the compromised user, prioritizing privileged access." ], "what_to_avoid": [ "Do not assume the attack is over by deleting the side-loading files; APT actors frequently establish secondary, redundant backdoors (like webshells).", "Avoid noisy remediation; coordinate a synchronized response, as tipping off the APT may cause them to rapidly exfiltrate data or deploy destructive payloads to cover their tracks." ], "target_industries": [ "Global / Opportunistic" ], "motivation": "Opportunistic", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "execution", "persistence" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "first_seen": 2012, "lineage": { "derived_from": [ "gh0st rat", "poison ivy" ], "variants": [ "plugx type i", "plugx type ii", "plugx type iii", "plugx p2p", "plugx / sogu usb worm" ] }, "attribution": [ { "actor": "Chinese State-Sponsored APT Groups (Mustang Panda, APT41, APT10, APT26) / 2024 Europol-Sekoia Disruption", "confidence": "high", "basis": "Widely documented by CISA, FBI, CERT-FR, and Europol as a core espionage tool used by Chinese intelligence operations. 2024 international disinfection sinkhole executed by Sekoia and French authorities disarming over 3 million infected endpoints.", "source": "https://attack.mitre.org/software/S0013/" } ], "exploited_cves": [ "CVE-2012-0158", "CVE-2014-1761", "CVE-2017-0199", "CVE-2020-0688" ], "c2_profile": { "protocols": [ "HTTP", "HTTPS", "DNS Tunneling", "Raw TCP", "UDP", "Custom Encrypted Triad Protocol" ], "ports": [ 80, 443, 53, 8080, 13579 ], "infrastructure": "Multi-tiered dynamic DNS and VPS proxy infrastructure with encrypted C2 beacons using XOR, RC4, or custom additive decompression algorithms to transmit exfiltrated files and execute remote shell commands." }, "iocs": { "file_hashes": [ "0f9df76435c4ea57a419ebca3bf437f1c1f51600863eb4cfae34898ce0ee68db", "62be64d2d473cf4c13488f7b7f3ee1ea2d1c69992f0fc9e6633b006bcfa1ea38" ], "delivery": [ "Targeted spear-phishing with malicious ZIP or RAR attachments dropping the DLL side-loading triad", "USB worm propagation using hidden directories and malicious shortcut (.lnk) files", "Exploitation of public-facing web servers (CVE-2020-0688 in Microsoft Exchange)" ], "persistence": [ "Windows service creation utilizing hijacked legitimate signed executables", "DLL side-loading via legitimate application directories (McAfee Mc.exe, Symantec ccSvcHst.exe)" ] }, "sources": [ { "name": "MITRE ATT&CK - PlugX (S0013)", "url": "https://attack.mitre.org/software/S0013/" }, { "name": "CISA Advisory - Chinese State-Sponsored Cyber Actors", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories" }, { "name": "Sekoia / Europol Technical Report on PlugX / Sogu Disinfection Operation", "url": "https://www.sekoia.io/" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }