PlugX High-Volume File and Directory Discovery

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•2•0•4

Detects high-volume file/directory enumeration behavior by the PlugX side-loaded process GRrte.exe, consistent with PlugX's use of FindFirstFileW/FindNextFileW/FindFirstFileExW for file and directory discovery (T1083).