Loading malware…
PlugX, also known as Korplug, Sogu, and Destroy RAT, is a modular remote access Trojan for Windows used primarily in cyberespionage and active since at least 2008. It is closely associated with the China-linked Mustang Panda group but is shared across numerous espionage actors, including APT10/menuPass, Calypso, Winnti Group, and Axiom. Observed deployments span government and diplomatic organizations as well as commercial targets, including manufacturing, shipping, and transportation companies.
PlugX provides persistent remote access, interactive command execution, file enumeration, and file upload and download capabilities that support document collection and exfiltration. Operators have used implants to discover remote systems within victim networks. Its plugin-based architecture supports additional functionality; variants such as MetaRAT and Talisman include keylogging, while MetaRAT also provides port mapping. Command-and-control communications can use raw TCP or UDP, with some variants additionally supporting HTTP, HTTPS, and ICMP. Persistence mechanisms include registry autorun entries, scheduled tasks, and Windows services.
Delivery methods include spear-phishing with malicious attachments or links, deceptive document-themed lures, and crafted Windows shortcuts. PlugX has also been deployed following exploitation of internet-facing servers. A USB-propagating variant spreads through removable media. Execution chains frequently use legitimate applications to sideload malicious DLLs, followed by payload decryption and in-memory loading. Evasion techniques include virtualization-related process checks, obfuscation, and, in particular variants, anti-debugging and injection into legitimate processes. Capabilities and implementation details vary substantially across the family’s variants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
30 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
2024년 5월 HFS의 원격 코드 실행 취약점인 CVE-2024-23692가 공개되었으며 이를 활용할 경우 공격자는 HFS에 명령이 포함된 패킷을 전송하여 HFS가 악성 명령을 실행하도록 할 수 있다.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
Microsoft was spurred to release out-of-band patches for the exploited bugs, known collectively as ProxyLogon, which are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.
A Windows LNK (shortcut) UI-misrepresentation vulnerability (CVE-2025-9491, ZDI-CAN-25373) is being actively exploited by a China-linked threat actor tracked as UNC6384 to deliver the PlugX Remote Access Trojan (RAT) against European diplomatic and government targets.
The report attributes initial intrusion to likely exploitation of CVE-2024-21893 and CVE-2024-21887. Files detected by Ivanti's Integrity Checker Tool matched filenames associated with LITTLELAMB, WOOLTEA, PITSOCK, and PITFUEL, and the observed evidence resembled previously reported attacks exploiting these vulnerabilities.
The report identifies CVE-2024-21893 and CVE-2024-21887 as the likely initial-entry vulnerabilities in a campaign targeting Japanese shipping and transportation companies and their subsidiaries. Numerous ERR31093 critical errors, associated with processing malicious SAML payloads exploiting CVE-2024-21893, were recorded near the suspected intrusion time.
RAT used for targeted attacks – Also known as Korplug/Gulpix/Sogu/Thoper/Destory RAT – Acknowledged in earlier 2012
The Microsoft Word document attachments observed in this campaign utilized CVE-2012-0158 to exploit the client and implant the PlugX RAT. | The attacks employed PlugX malware, a Remote Access Trojan (RAT) widely used in targeted attacks.
The Sanshiro series contains a vulnerability that allows arbitrary code execution (CVE-2014-0810), which was leveraged as a zero-day exploit by APT actors against Japanese government agencies. | Attackers leveraged a vulnerability in this program to attach a malicious file to an email, which infected the user with the PlugX malware.
The attacks observed in September 2013 leveraged another zero-day vulnerability in Internet Explorer (CVE-2013-3918). In these cases, the PlugX malware, a plug-in-based bot known as McRAT and a tunnelling tool, Htran, were later found in the victim’s environment. | Attackers leveraged a vulnerability in this program to attach a malicious file to an email, which infected the user with the PlugX malware.
They used various exploits such as Adobe Flash (CVE-2011-2462), Microsoft Office Word (CVE-2012-0158) and Ichitaro (CVE-2013-5990). | Attackers leveraged a vulnerability in this program to attach a malicious file to an email, which infected the user with the PlugX malware.
They used various exploits such as Adobe Flash (CVE-2011-2462), Microsoft Office Word (CVE-2012-0158) and Ichitaro (CVE-2013-5990). In the case of Ichitaro, the actor leveraged the vulnerability as a zero-day exploit. | Attackers leveraged a vulnerability in this program to attach a malicious file to an email, which infected the user with the PlugX malware.
CVE-2014-7247 was exploited as a zero-day vulnerability. The attack was carried out through targeted emails which were distributed to government agencies and enterprises in Japan. | Attackers leveraged a vulnerability in this program to attach a malicious file to an email, which infected the user with the PlugX malware.
Exploit public facing app: LookingFrog and JollyFrog CVE-2019-0604 ProxyLogon (March 2021) ProxyShell (August 2021)
Exploit public facing app: LookingFrog and JollyFrog CVE-2019-0604 ProxyLogon (March 2021) ProxyShell (August 2021)
As per my analysis, this variant of Poison Ivy eventually launches the MS17-010 (Eternal Blue) attack against the machines located inside the victim’s LAN... Based on our analysis, this new Poison Ivy variant takes advantage of the EternalBlue exploit to spread.
In late 2022, APT27 (also tracked as “Budworm”) exploited high-severity Log4j vulnerabilities (CVE‑2021‑44228 and CVE‑2021‑45105) to infect systems running Apache Tomcat and install web shells.
Post-exploitation included credential dumping (Mimikatz) and privilege escalation using CVE-2017-0213... overall attribution remains unresolved (APT27 vs. Winnti remains plausible).
In late 2022, APT27 (also tracked as “Budworm”) exploited high-severity Log4j vulnerabilities (CVE‑2021‑44228 and CVE‑2021‑45105) to infect systems running Apache Tomcat and install web shells.
Associated Analytic Story Spearphishing Attachments ... CVE-2023-36884 Office and Windows HTML RCE Vulnerability ... PlugX ... NjRAT
In May 2024, CVE-2024-24919, an information disclosure vulnerability in Check Point Quantum Security Gateways was exploited in the wild and tied to NailaoLocker ransomware (distributed via ShadowPad and PlugX backdoors, as documented by Orange Cyberdefense CERT).
attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan... In this campaign, attackers used a Microsoft Word document called 0721.doc, which exploits CVE-2017-0199. This vulnerability was disclosed and patched days prior to this attack.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
In one case, we could see that this variant was deployed following exploitation of the CVE-2020-0688 vulnerability on the network of a government entity. This vulnerability, which was publicly reported in February 2020, allows an authenticated user to run commands as SYSTEM on a Microsoft Exchange server. | Avira blogged about HoneyMyte PlugX variants... PlugX has been used by multiple APT groups over the past decade...
It appears to have started with CVE-2014-3393, a vulnerability in the Cisco Clientless SSL VPN portal... A vulnerability in the Clientless SSL VPN portal customization framework could allow an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal... An exploit could allow the attacker to bypass Clientless SSL VPN authentication and modify the portal content.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
Details on Exploited Vulnerabilities ... CVE-2021-40444 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve2 = “CVE-2021-40444”
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
35 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“PlugX is a modular RAT used for espionage that has been active since at least 2008, and it is most closely associated with the China-linked group Mustang Panda.”
Aside from the backdoors previously mentioned, this intrusion set also utilizes commonly used remote control tools like Cobalt Strike, PlugX, or Meterpreter stagers interchangeably in various attack stages.
This payload call sequence ... is very commonly used to run the PlugX backdoor.
This payload call sequence ... is very commonly used to run the PlugX backdoor.
This payload call sequence ... is very commonly used to run the PlugX backdoor.
This payload call sequence ... is very commonly used to run the PlugX backdoor.
48 distinct techniques documented for this family, organized by ATT&CK tactic.
«Проверка процессов (vmtoolsd, vbox.exe) ... PlugX, Remcos, EvilBunny»; «WMI-запросы ... GravityRAT, OopsIE»; «Ключи реестра ... Smoke Loader, ROKRAT».
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
1,413 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular Windows espionage RAT that executes commands, steals files, and persists through registry changes. Delivery includes phishing, DLL sideloading, and USB propagation in some variants. The article reports a January 2025 operation that removed it from more than 4,200 US computers using a built-in removal command.
A malware family mentioned only to describe Korplug's linkage; it is not otherwise discussed in the reference.
Remote-access trojan mentioned as part of a separate 2025 U.S. disruption operation involving systems infected by Mustang Panda.
Mentioned only as background concerning an earlier FBI operation against China-linked infrastructure. The article does not describe its capabilities or connect it to QTFY.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.