Loading story…
Trend Micro reported an APT intrusion involving PlugX malware in which the attacker used remotely created one-time scheduled tasks to execute payloads, rather than relying on scheduled tasks for persistence or privilege escalation. Investigators found the same user account was used to launch both PlugX and an auxiliary tool, a technique that likely complicated forensic reconstruction and EDR root-cause analysis while blending malicious activity with legitimate administration patterns.
The attacker also deleted tools from disk quickly—often within 15 minutes—reducing opportunities for responders to recover artifacts and analyze the toolset. Trend Micro said PlugX remained difficult to detect because it abused a legitimate-looking normal file, and it advised defenders to hunt for anomalous file locations, suspicious hashes and digital signers, mapped Windows administrative shares, and unusual scheduled-task activity as indicators of infection and lateral movement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
During the same intrusion, the attacker deleted tools from disk shortly after use, typically within 15 minutes, including an information-gathering tool before investigators could recover it. This forced investigators to rely heavily on telemetry to reconstruct the attack.
Trend Micro described an intrusion in which an attacker deployed PlugX malware and used remotely created one-time scheduled tasks to execute malware during the attack. The same user account launched both PlugX and an auxiliary tool, indicating the tasks were used for execution rather than persistence or privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported a PlugX malware campaign in which the remote access trojan was disguised as a legitimate Windows debugger tool, allowing it to blend into normal system activity and reduce suspicion during execution. PlugX is a long-running malware family associated with espionage operations, and its use of trusted-looking binaries reflects a continued emphasis on stealth, persistence, and defense evasion on compromised Windows hosts. The researchers found that the malware abused the appearance of a legitimate debugging utility to load malicious components while appearing benign to users and defenders. By hiding behind software that resembles standard Windows tooling, the operators increased the likelihood of successful infection and prolonged access, underscoring the need for organizations to validate signed and unsigned utilities, monitor suspicious DLL side-loading and process behavior, and hunt for PlugX-related activity across endpoints.
Jul 12, 2026
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026
Attackers have been exploiting remote code execution flaws in the Sunlogin and AweSun remote-control tools to compromise exposed systems and install multiple malware families, including **PlugX** and **Sliver**. AhnLab reported that vulnerable Sunlogin versions—especially releases earlier than `11.0.0.33`—were used in campaigns tied to `CNVD-2022-10270` and `CNVD-2022-03672`, with additional payloads such as **Gh0st RAT**, **XMRig**, and **Powercat** also observed. In one intrusion, the attackers used a PowerShell-based chain and a bring-your-own-vulnerable-driver (**BYOVD**) technique leveraging `mhyprot2.sys` to disable security tools before launching a reverse shell and later deploying a Sliver implant configured for **mTLS** command-and-control. In a separate but related campaign, attackers used Sunlogin and AweSun exploitation to deliver the **PlugX** backdoor through a DLL side-loading chain. A legitimate ESET executable, `esetservice.exe`, loaded a malicious `http_dll.dll`, which decrypted and executed PlugX from `lang.dat` directly in memory. AhnLab linked the activity to infrastructure at `imango[.]ink`, including `api.imango[.]ink` and `cdn.imango[.]ink` over ports `443` and `53`. The PlugX sample matched the **BackDoor.PlugX.38** family and supported UAC bypass, service installation, process injection, plugin execution, keylogging, clipboard theft, screenshot capture, remote shell access, and RDP-based propagation, underscoring continued abuse of remote-management software vulnerabilities for persistent backdoor deployment.
Aug 15, 2026