Loading story…
Sophos reported that a PlugX malware variant is propagating through USB removable media, allowing the threat to move between networks and geographic regions without relying solely on internet-based delivery. The worm-like behavior enables infected drives to carry the malware to new systems, where it can execute and continue spreading, extending the reach of a long-observed remote access trojan associated with espionage activity.
The campaign highlights the continued risk posed by air-gapped and intermittently connected environments, where USB devices remain a practical infection vector. By abusing removable drives for lateral movement and persistence, the operators behind PlugX can bypass some perimeter defenses and transport the malware into organizations through routine device sharing, reinforcing the need for stricter USB controls, endpoint monitoring, and detection of PlugX-related artifacts.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released a threat research article describing a PlugX malware campaign that spreads via USB devices across borders. No additional event details were provided in the reference content beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos has identified a new **PlugX USB worm** variant spreading through removable media in outbreaks across Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria, using DLL sideloading with legitimate `AvastSvc.exe`, a malicious `wsc.dll`, and an encrypted PlugX payload. The malware hides files on infected USB drives, gathers host reconnaissance, and steals Office and PDF documents up to 300 MB, storing them in encrypted form under `RECYCLER.BIN` with base64-obfuscated filenames before attempting exfiltration to infrastructure including `45.142.166[.]112`. The activity aligns with the long-running **PKPLUG** espionage cluster, which researchers have previously attributed with high confidence to a Chinese nation-state adversary targeting victims in and around Southeast Asia, including Xinjiang, Mongolia, Myanmar, and Taiwan. Earlier reporting tied PKPLUG to malware families including **PlugX**, **Poison Ivy**, **9002**, **Zupdax**, **Farseer**, and the Android spyware **HenBox**, and documented overlapping infrastructure, DLL sideloading, registry-based persistence, and surveillance-focused collection against regional targets, reinforcing the assessment that the new worm is part of a broader intelligence-gathering campaign.
Aug 15, 2026
Mandiant reported a cyber-espionage operation that used **infected USB drives** to compromise targeted systems and steal sensitive information. The activity relied on removable media as an initial access vector, allowing attackers to bridge environments where internet connectivity or standard phishing routes may be limited, and then collect data from victim networks. The campaign highlights the continued effectiveness of **USB-borne intrusion techniques** in espionage operations, particularly against organizations that handle confidential material or operate in segmented environments. Mandiant said the attackers used the malicious drives to gain footholds on victim machines and facilitate data theft, underscoring the need for tighter controls on removable media, endpoint monitoring, and restrictions on unauthorized USB device use.
Jul 12, 2026
Trend Micro reported a PlugX malware campaign in which the remote access trojan was disguised as a legitimate Windows debugger tool, allowing it to blend into normal system activity and reduce suspicion during execution. PlugX is a long-running malware family associated with espionage operations, and its use of trusted-looking binaries reflects a continued emphasis on stealth, persistence, and defense evasion on compromised Windows hosts. The researchers found that the malware abused the appearance of a legitimate debugging utility to load malicious components while appearing benign to users and defenders. By hiding behind software that resembles standard Windows tooling, the operators increased the likelihood of successful infection and prolonged access, underscoring the need for organizations to validate signed and unsigned utilities, monitor suspicious DLL side-loading and process behavior, and hunt for PlugX-related activity across endpoints.
Jul 12, 2026