PKPLUG Linked to Chinese Espionage Campaigns Across Southeast Asia

Palo Alto Networks Unit 42 reported that the PKPLUG intrusion set conducted long-running cyber espionage operations across Asia, particularly in Southeast Asia, and assessed with high confidence that the activity is tied to Chinese nation-state adversaries. The group was described as active for at least six years and focused on targets in Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet, and Xinjiang, indicating intelligence collection against politically and geopolitically sensitive organizations and communities.

The campaigns used a combination of public and custom malware, including PlugX, Poison Ivy, Zupdax, 9002, HenBox, and the previously unknown Windows backdoor Farseer, with DLL side-loading and spear-phishing repeatedly used for delivery and execution. Unit 42 said overlapping infrastructure, malware characteristics, and shared tactics connected multiple previously reported operations under the PKPLUG umbrella, while HenBox expanded the threat to Android devices—especially targeting Uyghurs and Xiaomi devices—and the researchers released a STIX 2.0 adversary playbook consolidating indicators, campaigns, and ATT&CK-mapped techniques.