ctrlINT What the industry said about every indicator, with the quote

DOPLUGSMalware

Last reported 7 months ago, by Zscaler ThreatLabz2 reports

ATT&CK techniques

6 of 44 · each with the sentence it comes from
  1. T1684Social Engineering

    “…or a particular group of activities with modern TTPs characterized by AI-generated attacks, sophisticated phishing attacks, and/or social engineering).”

    Trend Micro ResearchVendor
  2. T1027Obfuscated Files or Information

    “T1027”

    Zscaler ThreatLabzVendor
  3. T1027.002Software Packing

    “T1027.002”

    Zscaler ThreatLabzVendor
  4. T1027.007Dynamic API Resolution

    “T1027.007”

    Zscaler ThreatLabzVendor
  5. T1027.009Embedded Payloads

    “T1027.009”

    Zscaler ThreatLabzVendor
  6. T1027.013Encrypted/Encoded File

    “T1027.013”

    Zscaler ThreatLabzVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “The PlugX backdoor variant used in this attack has heavy code overlaps with the DOPLUGS campaign described in 2024.”

    Zscaler ThreatLabzVendor
    China-nexus Threat Actor Targets Arabian Gulf Region With PlugX

  2. “Campaigns such as Stately Taurus highlight intrusions into Southeast Asian government environments, supported by DOPLUGS and PubLoad loaders for modular payload execution.”

    Trend Micro ResearchVendor
    Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with DOPLUGS here?
No account needed. We do not store your IP address.