{
  "family": "korplug",
  "sample_count": 10,
  "category": "trojan",
  "description": "Backdoor:Win32/Korplug (widely known in the cybersecurity community as **PlugX**) is a highly customized, persistent Remote Access Trojan (RAT) used extensively since 2012 by numerous Chinese state-sponsored APT groups (including APT41, Mustang Panda, and APT10). PlugX is heavily utilized for cyber espionage, deep network reconnaissance, and long-term data exfiltration against government, technology, and telecommunications targets globally.<br><br><b>Understanding Korplug (PlugX)</b><br>To the victim, the infection is entirely invisible. For a threat intelligence analyst, a PlugX detection is a critical national security incident. It indicates that the organization is actively being targeted by a top-tier Chinese cyber espionage unit. PlugX is notable for its modular architecture; the core backdoor can load various plugins on the fly to perform keylogging, screen capture, SQL dumping, and lateral movement, all without dropping new files to disk.<br><br><b>Execution and DLL Side-Loading Mechanics</b><br>APT groups typically distribute PlugX via highly targeted spearphishing (`T1566.001`) or by exploiting external-facing vulnerabilities (`T1190`). PlugX is famous for popularizing the technique of **DLL Side-Loading** (`T1574.002`). The attackers drop three files: a legitimate, digitally signed executable (e.g., an old version of a Symantec or Google updater), a malicious DLL payload, and an encrypted `.dat` file containing the true PlugX shellcode. When the legitimate executable runs, it inadvertently loads the malicious DLL, which decrypts and injects the PlugX payload directly into memory (`T1055.001`). This bypasses many EDR solutions because the executing process is signed and trusted. PlugX then establishes a covert C2 channel (often custom encrypted TCP/HTTP) (`T1071.001`) to begin data exfiltration (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating, long-term compromise of intellectual property and state secrets. The classic IoC is the 'Trifecta' of files dropped in a temporary or application directory: a legitimate `.exe`, a suspicious `.dll`, and a `.dat` or `.bin` file. EDR logs will show the legitimate, signed executable establishing anomalous, beaconing outbound network connections.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.001",
    "T1566.001",
    "T1071.001",
    "T1041",
    "T1574.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading (The classic PlugX technique)",
      "tactic": "Persistence"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; an active PlugX infection means a highly skilled nation-state actor is operating within the network.",
    "Assume all local credentials, browser passwords, and sensitive documents on the machine have been compromised. Enforce immediate password resets.",
    "Do not attempt a standard remediation; capture a full memory dump (RAM) and forensic disk image. The memory dump is crucial to extract the decrypted PlugX plugins.",
    "Perform a complete bare-metal wipe and reinstall of the operating system; APT actors utilize highly advanced, undocumented persistence mechanisms."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over if one PlugX instance is quarantined; these actors frequently deploy multiple, redundant backdoors.",
    "Avoid tipping off the adversary; coordinate with specialized incident response teams before taking noisy containment actions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}