Loading threat actor…
PKPLUG is a Chinese cyberespionage threat cluster tracked across Asia for multiple years and assessed with high confidence to have Chinese nation-state origins. The designation has been used for one group or possibly multiple closely related groups that share tooling, infrastructure patterns, and tasking. PKPLUG is best known for extensive use of PlugX, but activity linked to the cluster has also involved HenBox, Farseer, Poison Ivy, Zupdax, and the 9002 Trojan. PKPLUG’s operations are primarily oriented toward espionage, information gathering, and victim tracking. Reported targeting has focused on politically and geopolitically sensitive populations and organizations in and around Southeast Asia, including Myanmar, Taiwan, Mongolia, Xinjiang, Tibet, Vietnam, and Indonesia. HenBox activity associated with the cluster particularly targeted Uyghur users and Xiaomi or MIUI devices, indicating an interest in mobile surveillance as well as traditional Windows intrusions. Operationally, PKPLUG has relied heavily on spearphishing and DLL sideloading to deliver and execute malware. Documented campaigns have used weaponized documents, ZIP-packaged sideloading chains, legitimate signed executables abused as loaders, and Android trojanized applications distributed through third-party app stores. Windows malware linked to the cluster has established persistence through registry run keys, scheduled execution, and sideloaded components, while mobile malware has used extensive Android event triggers, icon hiding, obfuscation, and encrypted configuration storage. PlugX-associated activity tied to PKPLUG includes second-stage backdoor deployment after server compromise, including Exchange exploitation in 2021, and use of modular remote-access capabilities such as command execution, file operations, service installation, screen capture, keylogging, registry manipulation, and network tunneling or proxying through plugins. Farseer represents a related Windows backdoor family traced to at least 2016 that uses registry-based persistence and DLL sideloading with a signed Microsoft Visual Studio component. HenBox is an Android surveillance platform capable of collecting device and personal information, contacts, messages, call data, location, installed applications, and data from major messaging platforms, while also accessing microphones and cameras. Infrastructure and malware overlaps have linked PKPLUG activity to broader Chinese intrusion ecosystems, and PlugX usage has also been associated in some reporting with Mustang Panda. However, the PKPLUG label specifically refers to the espionage cluster defined around these related campaigns and malware relationships. Overall, PKPLUG is a capable long-running espionage adversary focused on covert access, persistence, surveillance, credential collection, and data exfiltration against regional political, governmental, and strategic targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
194 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as a Chinese APT group known to use the PlugX backdoor, including via DLL side-loading to evade detection.
Referenced only because prior reporting allegedly linked PlugX-related activity to this Chinese group; no direct attribution is made in this report.
Third-party named activity cluster associated with a malware set including PlugX, Zupdax, 9002 RAT, and Poison Ivy (via HenBox-linked infrastructure). Included here as a referenced cluster connected by malware/infrastructure overlap, not as a confirmed attribution to Space Pirates.
Chinese cyberespionage activity cluster associated with use of PlugX, including THOR/PLUG variants, infrastructure overlaps, and campaigns targeting compromised Microsoft Exchange servers and prior activity in Southeast Asia.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.