Loading story…
Attackers have been exploiting remote code execution flaws in the Sunlogin and AweSun remote-control tools to compromise exposed systems and install multiple malware families, including PlugX and Sliver. AhnLab reported that vulnerable Sunlogin versions—especially releases earlier than 11.0.0.33—were used in campaigns tied to CNVD-2022-10270 and CNVD-2022-03672, with additional payloads such as Gh0st RAT, XMRig, and Powercat also observed. In one intrusion, the attackers used a PowerShell-based chain and a bring-your-own-vulnerable-driver (BYOVD) technique leveraging mhyprot2.sys to disable security tools before launching a reverse shell and later deploying a Sliver implant configured for mTLS command-and-control.
In a separate but related campaign, attackers used Sunlogin and AweSun exploitation to deliver the PlugX backdoor through a DLL side-loading chain. A legitimate ESET executable, esetservice.exe, loaded a malicious http_dll.dll, which decrypted and executed PlugX from lang.dat directly in memory. AhnLab linked the activity to infrastructure at imango[.]ink, including api.imango[.]ink and cdn.imango[.]ink over ports 443 and 53. The PlugX sample matched the BackDoor.PlugX.38 family and supported UAC bypass, service installation, process injection, plugin execution, keylogging, clipboard theft, screenshot capture, remote shell access, and RDP-based propagation, underscoring continued abuse of remote-management software vulnerabilities for persistent backdoor deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
AhnLab found a WinRAR SFX PlugX dropper on VirusTotal that created esetservice.exe, http_dll.dll, and lang.dat, then executed the loader chain. The company assessed that the same threat actor likely conducted both the vulnerability exploitation and the dropper campaign because both used the imango[.]ink command-and-control infrastructure.
AhnLab reported that attackers were exploiting remote code execution weaknesses in Sunlogin and AweSun to install the PlugX backdoor. The observed chain used a legitimate ESET executable, a malicious http_dll.dll, and an encrypted lang.dat payload to launch PlugX in memory via DLL side-loading.
AhnLab published research describing ongoing exploitation of Sunlogin vulnerabilities to deploy malware including Sliver, Gh0st RAT, XMRig CoinMiner, and Powercat. The report also detailed a recent BYOVD-based attack chain using a modified Mhyprot2DrvControl and the vulnerable mhyprot2.sys driver to disable security tools before launching a reverse shell.
AhnLab reported that exploit code for Sunlogin remote code execution vulnerabilities CNVD-2022-10270 and CNVD-2022-03672 was publicly available in 2022, enabling later abuse in intrusion campaigns.
AhnLab stated that multiple attacks targeting vulnerable Sunlogin instances had been confirmed in ASD logs since early 2022. These attacks involved malware such as Gh0st RAT and XMRig CoinMiner delivered through Sunlogin remote code execution flaws.
MITRE ATT&CK published its software entry for PlugX (S0013), documenting the malware family in its knowledge base.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple analyses detailed **PlugX** malware infections that relied on DLL side-loading and staged, in-memory execution to launch the final remote access trojan while minimizing on-disk artifacts. In one chain, a signed McAfee executable loaded a malicious `McUtil.dll`, which patched the host process and executed shellcode from `Mc.cp`; that shellcode decrypted and manually mapped a final PlugX DLL, which then injected into `svchost.exe` and contacted `45.79.125.11:443`. A separate CIRCL report described a PlugX 7.0 variant delivered in a self-extracting archive that dropped a signed McAfee binary, a malicious DLL, and an encrypted payload, then decrypted and decompressed the payload in memory before injecting it into `svchost.exe` and `msiexec.exe` and beaconing to `help.yahoo-upgrade.com:443`. Other samples tied to **Mustang Panda** and COVID-19-themed lures showed the same tradecraft with different loaders and decoys. One Mustang Panda sample used a malicious shortcut, a renamed legitimate LogMeIn executable, `LMIGuardianDll.dll`, and `LMIGuardianDat.dat` to decrypt shellcode, manually map a PlugX DLL, and display a decoy document named **"Written comments of Hungary.docx"**; its configuration was XOR-encrypted with the key `jOh752oCI`. Another fileless chain abused `unsecapp.exe` to load `http_dll.dll`, decrypt `http_dll.dat` in memory, and execute a final PlugX payload that established persistence through Run keys, communicated over HTTP POST or raw TCP on ports `80`, `443`, `8080`, and `8000`, and supported remote shell, file operations, reconnaissance, and hidden process execution.
Aug 15, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026