Loading story…
Trellix disclosed a newly identified PlugX malware variant dubbed Talisman that was used against telecommunications and defense organizations in South Asia. The malware is delivered through DLL sideloading with a signed benign executable, a modified malicious DLL, and an encrypted payload, ultimately deploying a backdoor that supports modular plug-ins. Researchers said the campaign aligns with Chinese geopolitical interests in the region and assessed with medium confidence that it is linked to the Chinese state-backed RedFoxtrot group, also known as Nomad Panda.
Talisman was reported as a distinct PlugX lineage, differing from previously documented samples such as BackDoor.PlugX.38 through a unique internal signature, altered decryption logic, and minor code changes while preserving core PlugX behavior. Trellix said the malware retains familiar capabilities including persistence, process injection, and plug-in extensibility, and identified command-and-control infrastructure using Dynamic DNS services and VPS hosting that overlaps with earlier RedFoxtrot and related PCShare activity.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Dr.Web published a malware description library entry for BackDoor.PlugX.38, documenting this PlugX family malware variant in its database.
Trellix reported that the embedded plug-ins found in the analyzed Talisman PlugX samples carried creation dates in 2018 in their metadata. This is the earliest explicit temporal anchor in the reference content.
Trellix disclosed a newly discovered PlugX variant dubbed Talisman, describing its DLL sideloading execution chain, modified decryption logic, and plug-in-enabled backdoor capabilities. The researchers assessed with medium confidence that the campaign was linked to the Chinese state-backed RedFoxtrot group based on infrastructure overlaps and victimology involving telecommunications and defense targets in South Asia.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026