Recently, our team identified the use of the PlugX Trojan (MITRE ID: S0013) within Italian corporate systems. The Trojan managed to infiltrate the target systems through the use of an infected USB device.
The system compromise is executed through the techniques of Replication Through Removable Media (T1091) and DLL Side-Loading (T1073).
In recent months, several technical articles have been published concerning the use of the PlugX Trojan. A recent analysis revealed that the Trojan has been enhanced with the HTML Smuggling technique, used in the initial phase of compromising the victim system.
PlugX, also known as Destroy RAT, Kaba, Korplug, Sogu, TIGERPLUG, and RedDelta, has been in existence since 2008 and is categorized as a Remote Access Trojan (RAT). Over time, it has undergone continuous modifications and improvements to evade security defenses.
The reuse of parts of its code by various Threat Actors has contributed to the malware’s spread, leading to numerous different versions.
Some analyses of this malware (by TrendMicro and Sophos) associate it with operations of Chinese APT groups. Its use has often been observed in compromises involving critical sectors such as the energy industry, defense, technology, the financial sector, and government institutions.
Recently, the focus of these Threat Actors has been shifting towards European entities, which are victims of an increasing number of attacks.
The variant of PlugX observed by our team exploits the execution of a .lnk file contained within a compromised USB device. When the user clicks on this file, the following command is executed:
"C:\Windows\System32\cmd.exe" /q /c " \ \RECYCLER.BIN\files\x32dbg.exe"
This executes the legitimate software “x32dbg.exe”, associated with the loading of the malicious dll “x32bridge.dll”.
This mechanism is known as “DLL Side-Loading” (T1073) and involves creating a malicious DLL with the same name as a legitimate DLL, so that it is loaded by legitimate software without raising suspicion.
The information obtained from the analysis suggests that, in this specific case, it is not an attack aimed at compromising the involved organization, but rather an inadvertent result of previous compromises.
This variant of the trojan contacts the Command and Control (C2) server at the IP address 160.20.147[.]254 (Germany – ROUTERHOSTING).
The increased targeting of European users and the detection of the malware in Italy are indicators of an evolution and update in the attack patterns of PlugX. It represents a particularly complex and insidious threat, especially as it is used for espionage activities typical of various Advanced Persistent Threat (APT) groups. These groups carry out targeted attacks with specific objectives to extract sensitive information.
At the end of this article, we share the Indicators of Compromise (IOCs) associated with this threat.
|T1218||System Binary Proxy Execution||Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.|
|T1036||Masquerading||Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses.|
|T1574||Hijack Execution Flow||Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.|
|T1202||Indirect Command Execution||Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.|
|T1073||DLL Side-Loading||Adversaries may execute their own malicious payloads by side-loading DLLs.|
|T1140||Deobfuscate/Decode Files or Information||Adversaries may require separate mechanisms to decode or deobfuscate information depending on how they intend to use it.|
|T1603||Scheduled Task/Job||Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.|
|T1547||Boot or Logon Autostart Execution||Adversaries may configure system settings to automatically execute a program during system boot to maintain persistence on compromised systems.|
|T1204||User Execution||An adversary may rely upon specific actions by a user to gain execution.|
Indicator of Compromise (IOC)