Executive Summary
PlugX (also known as Korplug and Sogu) is a long-standing Remote Access Trojan (RAT) primarily attributed to Chinese Advanced Persistent Threat (APT) groups, most notably Mustang Panda. Active since 2008, it remains a modular and evolving threat used for large-scale espionage, targeting various sectors with a focus on organizations in Asia.
The malware typically gains initial access through phishing archives or infected USB devices. Once executed, it employs sophisticated evasion techniques, specifically DLL side-loading using legitimate signed binaries from vendors like ESET to mask its activity. PlugX is designed for comprehensive system surveillance, including keystroke logging, screen recording, and full file system manipulation, while maintaining persistence through Windows Registry modifications.
This threat is critical for organizations due to its ability to bypass traditional antivirus through trusted process injection and its dual-use as a reconnaissance and exfiltration platform. The recent samples identified in late 2026 demonstrate continued refinement in its execution chain, specifically targeting legitimate service processes to escalate privileges.