PlugX

First seen

2008-06-01 00:00:00

Malware type

rat

Family

Malware family

Operating systems

windows

Related IoCs

1265 (824 malicious)

Last IoC activity

2026-10-17 01:01:34

Profile updated

2026-07-07 15:46:30

Targeted industries: government-and-public-sector defense-and-aerospace healthcare-and-pharmaceutical technology-and-telecommunications

Targeted regions: country_code:cn country_code:us country_code:hk country_code:tw

Context

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.

Recent IoC activity

824 malicious indicators in Maltiverse are attributed to PlugX (S0013). The 20 most recently updated:

Detection coverage

• 10 YARA rules
• 749 Sigma rules

Malware & tools used

• Debugger Evasion (attack-pattern)
• Modify Registry (attack-pattern)
• File and Directory Discovery (attack-pattern)
• System Location Discovery (attack-pattern)
• Masquerade Task or Service (attack-pattern)
• Replication Through Removable Media (attack-pattern)
• Mutual Exclusion (attack-pattern)
• System Network Configuration Discovery (attack-pattern)
• Hidden Files and Directories (attack-pattern)
• Non-Application Layer Protocol (attack-pattern)
• Malicious File (attack-pattern)
• Local Storage Discovery (attack-pattern)
• Keylogging (attack-pattern)
• Dead Drop Resolver (attack-pattern)
• System Time Discovery (attack-pattern)
• Reflective Code Loading (attack-pattern)
• Process Discovery (attack-pattern)
• Query Registry (attack-pattern)
• DLL (attack-pattern)
• Clear Persistence (attack-pattern)
• Network Share Discovery (attack-pattern)
• MSBuild (attack-pattern)
• Web Protocols (attack-pattern)
• Windows Service (attack-pattern)
• Windows Command Shell (attack-pattern)

Used by threat actors

• RedDelta Modified PlugX Infection Chain Operations (campaign)
• RedDelta Updated PlugX Infection Chain (Deprecated) (campaign)
• RedGolf (threat-actor)
• Threat Group-3390 (threat-actor)
• Winnti Group (threat-actor)
• Cinnamon Tempest (threat-actor)
• Mustang Panda (threat-actor)
• Velvet Ant (threat-actor)
• Axiom (threat-actor)
• APT41 (threat-actor)
• DragonOK (threat-actor)
• APT3 (threat-actor)
• TA459 (threat-actor)
• GALLIUM (threat-actor)
• menuPass (threat-actor)
• LuminousMoth (threat-actor)
• Higaisa (threat-actor)
• Daggerfly (threat-actor)

Detection rules

• SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 (yara-rule)
• SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 (yara-rule)
• SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 (yara-rule)
• SEKOIA_Apt_Mustangpanda_Maliciousdll_Loading_Plugx_Strings (yara-rule)
• SEKOIA_Plugx_Final_Payload (yara-rule)
• MALPEDIA_Win_Plugx_Auto (yara-rule)
• ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 (yara-rule)
• SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23 (yara-rule)
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23 (yara-rule)
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23 (yara-rule)

Reports & references

• secureworks.com — Bronze Express (report)
• threatconnect.com — Research Roundup Activity On Previously Identified Apt33 Domains (report)
• secureworks.com — Bronze Overbrook (report)
• Palo Alto Unit 42 — Shallowtaurus (report)
• secureworks.com — Bronze Olive (report)
• go.recordedfuture.com — Cta 2023 0330 (report)
• Broadcom/Symantec — Lancefly Merdoor Zxshell Custom Backdoor (report)
• computerweekly.com — New Threat Group Behind Airbus Cyber Attacks Claim Researchers (report)
• recordedfuture.com — Redecho Targeting Indian Power Sector (report)
• therecord.media — Redecho Group Parks Domains After Public Exposure (report)
• Trend Micro — Wp Operation Earth Berberoka (report)
• Trend Micro — New Apt Group Earth Berberoka Targets Gambling Websites With Old (report)
• Trend Micro — Earth Berberoka Windows Iocs 2.Txt (report)
• botconf.eu — Botconf2022 40 Lunghihorejsi (report)
• Kaspersky — 97937 (report)
• i.blackhat.com — As 22 Leonsilvia Nextgenplugxshadowpad (report)
• Kaspersky — 97157 (report)
• go.recordedfuture.com — Cta 2023 0808 (report)
• youtube.com — Watch (report)
• app.box.com — Z1Uanuv1Vn3Vw5Iket1R6Bqrmlra0Gpn (report)
• secureworks.com — Bronze Starlight Ransomware Operations Use Hui Loader (report)
• MITRE ATT&CK — G1021 (report)
• CrowdStrike — Report2021Gtr (report)
• cloud.google.com — Prc Nexus Espionage Targets Diplomats (report)
• ESET — Mustang Panda Hodur Old Tricks New Korplug Variant (report)

External references

• mitre-attack — S0013
• DestroyRAT
• Kaba
• PlugX
• Korplug
• Sogu
• Thoper
• TVT
• CIRCL PlugX March 2013
• Dell TG-3390
• New DragonOK
• Novetta-Axiom
• FireEye Clandestine Fox Part 2
• Lastline PlugX Analysis
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy