ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > List all tools > List all groups using tool PlugX

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: PlugX

NamesPlugX
Destroy RAT
DestroyRAT
Korplug
Sogu
Kaba
Xamtrav
Agent.dhwf
RedDelta
TIGERPLUG
Thoper
TVT
CategoryMalware
TypeReconnaissance, Backdoor, Keylogger, Info stealer, Exfiltration
Description(US-CERT) PLUGX is a sophisticated Remote Access Tool (RAT) operating since approximately 2012. Although there are now many variants of this RAT in existence today, there are still characteristics common to most variants.
Information<https://www.us-cert.gov/ncas/alerts/TA17-117A>
<https://threatrecon.nshc.net/2019/03/19/sectorm04-targeting-singapore-custom-malware-analysis/>
<http://blog.jpcert.or.jp/2015/01/analysis-of-a-r-ff05.html>
<http://blog.jpcert.or.jp/2017/02/plugx-poison-iv-919a.html>
<http://blog.jpcert.or.jp/.s/2017/04/redleaves---malware-based-on-open-source-rat.html>
<https://countuponsecurity.com/2018/02/04/malware-analysis-plugx/>
<https://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf>
<https://www.rsa.com/content/dam/pdfs/2-2017/kingslayer-a-supply-chain-attack.pdf>
<https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf>
<http://blog.airbuscybersecurity.com/post/2014/01/plugx-some-uncovered-points.html>
<https://community.rsa.com/thread/185439>
<https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/>
<https://www.lac.co.jp/lacwatch/people/20171218_001445.html>
<https://countuponsecurity.com/2018/05/09/malware-analysis-plugx-part-2/>
<https://securelist.com/time-of-death-connected-medicine/84315/>
<https://www.arbornetworks.com/blog/asert/wp-content/uploads/2016/01/ASERT-Threat-Intelligence-Brief-2015-08-Uncovering-the-Seven-Point-Dagger.pdf>
<https://blog.malwarebytes.com/threat-analysis/2016/08/unpacking-the-spyware-disguised-as-antivirus/>
<https://www.sophos.com/en-us/medialibrary/pdfs/technical%20papers/plugx-thenextgeneration.pdf>
<https://www.cybereason.com/blog/threat-analysis-report-plugx-rat-loader-evolution>
<https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/>
<https://asec.ahnlab.com/en/49097/>
<https://blog.sekoia.io/unplugging-plugx-sinkholing-the-plugx-usb-worm-botnet/>
<https://www.bleepingcomputer.com/news/security/french-police-push-plugx-malware-self-destruct-payload-to-clean-pcs/>
<https://www.bleepingcomputer.com/news/security/fbi-deletes-chinese-plugx-malware-from-thousands-of-us-computers/>
MITRE ATT&CK<https://attack.mitre.org/software/S0013/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:plugx>
Playbook<https://pan-unit42.github.io/playbook_viewer/?pb=plugx-malware>

Last change to this tool card: 22 February 2025

Download this tool card in JSON format

All groups using tool PlugX

ChangedNameCountryObserved

APT groups

XAPT 3, Gothic Panda, BuckeyeChina2007-Nov 2017X
 APT 17, Deputy Dog, Elderwood, Sneaky PandaChina2009-Jun 2024 
 APT 20, Violin PandaChina2014-2017 
XAPT 31, Judgment Panda, ZirconiumChina2016-Mar 2024X
XAPT 41China2012-Oct 2024X
 AVIVOREChina2015 
 Axiom, Group 72China2008-2008/2014 
XBariumChina2016-Nov 2017X
 BookwormChina2015 
XBronze StarlightChina2021-Mar 2023 
 CalypsoChina2016-Aug 2021 
 CarderbeeChina2023 
 CardinalLizardChina2014 
 DragonOKChina2015-Jan 2017 
 Earth BerberokaChina2022 
 Earth KrahangChina2022 
XEmissary Panda, APT 27, LuckyMouse, Bronze UnionChina2010-Aug 2023 
 Goblin Panda, Cycldek, ConimesChina2013-Jun 2020 
 IronHuskyChina2017-Aug 2021 
XLeviathan, APT 40, TEMP.PeriscopeChina2013-Jul 2021X
XMustang Panda, Bronze PresidentChina2012-Jun 2025 HOT 
 Naikon, Lotus PandaChina2010-Apr 2022 
 NetTraveler, APT 21, Hammer PandaChina2004-Dec 2015 
 Nightshade Panda, APT 9, Group 27China2013-Sep 2016 
 Operation Diplomatic SpecterChina2022 
 Operation HarvestChina2016 
 Operation JacanaChina2023 
 RedDeltaChina2020-Jul 2023 
 RedFoxtrotChina2014-Aug 2021 
 RedGolfChina2014 
 Roaming TigerChina2014-Aug 2015 
 Samurai PandaChina2009 
 Space PiratesChina2017-Nov 2024 
XStone Panda, APT 10, menuPassChina2006-Mar 2025X
 TA428China2013-Jan 2022 
 TA459China2017-Apr 2022 
XTurbine Panda, APT 26, Shell Crew, WebMasters, KungFu KittensChina2010-Oct 2018X
 Velvet AntChina2023-Jul 2024 
 Wicked Spider, APT 22China2018 

39 groups listed (39 APT, 0 other, 0 unknown)

↑

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents
Telephone +66 (0)2-123-1227
E-mail [email protected]