PlugXMalware
- destroy rat
- destroyrat
- Kaba
- korplug
- sogu
- thoper
- tigerplug
RSA describes PlugX as a RAT (Remote Access Trojan) malware family that is around since 2008 and is used as a backdoor to control the victim's machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system.From MISP Galaxy
Last reported 3 days ago, by The Hacker News12 reports
ATT&CK techniques
6 of 83 · each with the sentence it comes from- T1036Masquerading
“Masquerading: Match Legitimate Name”
- T1027Obfuscated Files or Information
“T1027”
- T1140Deobfuscate/Decode Files or Information
“T1140”
- T1574Hijack Execution Flow
“Hijack Execution Flow: DLL Side-Loading”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
12 reports, newest first · the exact sentence from each-
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections“Kaba encountered the attack on the morning of October 2, when an SSH connection over Tor returned a changed-key warning.”
-
Sekoia Honeypot Captures an Attack on GenAI Infrastructure“…tforms, online casinos, and betting sites, relying on multiplatform malware families historically attributed to Chinese-speaking actors (PlugX, Gh0st RAT, PuppetLoader).”
-
Cyber Brief 26-05 - April 2026“Fake website impersonating Anthropic's Claude delivers PlugX”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“A similar G DATA binary has been used recently by Chinese APT to load PlugX malware.”
-
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement“Our analysis of C2 netflow data revealed that suspected China- and India-nexus threat actors operating PlugX, ShadowPad, Cobalt Strike, and Remcos infrastructure have converged on this victim class.”
-
Strategic Autonomy in Cybersecurity: Where you Get to Choose“We also cooperated with the FBI on the global disinfection campaign against the PlugX worm in 2025.”
-
PlugX worm disinfection campaign feedbacks“PlugX worm disinfection campaign feedbacks”
-
China's State-Sponsored Cyber Operations & Ecosystem“Patriotic hackers professionalised after 2002 and contributed to payloads like PlugX and ShadowPad under Military-Civil Fusion.”
-
Meet Sekoia TDR: Our Threat Detection & Research Team“In September 2023, we successfully sinkholed a command and control server linked to the PlugX worms.”
-
China-nexus Threat Actor Targets Arabian Gulf Region With PlugX“China-nexus Threat Actor Targets Arabian Gulf Region With PlugX”
-
Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™“Earth Preta first appeared using PlugX/Korplug RAT, delivered through basic spear-phishing attachments and decoy documents.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“The backdoor PlugX, attributed by cybersecurity researchers to Chinese threat actors, is the first to spring to mind regarding this technique.”
Thanks — we review every report.