PlugX

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)

Associated Techniques (49)
ID ATT&CK Tactics
T1012 Query Registry -
T1016 System Network Configuration Discovery -
T1027 Obfuscated Files or Information -
T1027.001 Binary Padding -
T1027.007 Dynamic API Resolution -
T1027.013 Encrypted/Encoded File -
T1033 System Owner/User Discovery -
T1036.004 Masquerade Task or Service -
T1036.005 Match Legitimate Resource Name or Location -
T1041 Exfiltration Over C2 Channel -
T1049 System Network Connections Discovery -
T1053.005 Scheduled Task -
T1056.001 Keylogging -
T1057 Process Discovery -
T1059.003 Windows Command Shell -
Aliases (630)
Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug Thoper TVT DestroyRAT Sogu Kaba Korplug
Used by Actors (15)
APT3
Nation-state
APT41
Nation-state
Axiom
Unknown
Cinnamon Tempest
Unknown
Daggerfly
Unknown
DragonOK
Nation-state
GALLIUM
Unknown
Higaisa
Nation-state
LuminousMoth
Unknown
menuPass
Unknown
Metadata
ID: 297
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00