POISONPLUG
Aliases: Barlaiy
- First seen
- 2013-05-01 00:00:00
- Malware type
- backdoor
- Family
- Malware family
- Profile updated
- 2026-07-07 12:55:47
Targeted industries: government-and-public-sector financial-services technology-and-telecommunications
Context
According to FireEye, POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded C&C commands.
Reports & references
- slideshare.net — Cb19 Cyber Threat Landscape In Japan Revealing Threat In The Shadow By Chi En Shen Ashley Oleg Bondarenko (report)
- Mandiant — Cds19 Executive S08 Achievement Unlocked (report)
- Kaspersky — 99204 (report)
- Mandiant — Rpt Apt41 (report)
- Broadcom/Symantec — Apt41 Indictments China Espionage (report)
- Mandiant — Lowkey Hunting For The Missing Volume Serial Id (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Poisonplug (report)
- cloud.google.com — Scatterbrain Unmasking Poisonplug Obfuscator (report)