Doplugs

DOPLUGS is a variant of the PlugX malware, developed and deployed by the China-linked Advanced Persistent Threat (APT) group Mustang Panda. Active since 2022, this unique malware has been used in targeted campaigns against various Asian countries including Taiwan, Vietnam, India, Japan, and China. Unlike the standard PlugX backdoor, DOPLUGS includes a completed backdoor command module and acts as a downloader supporting four backdoor commands. This customized version of PlugX has been found to be distinct from the general type, leading researchers to assign it a new name: DOPLUGS. The threat actors have employed spear-phishing emails containing a Google Drive link to distribute the DOPLUGS malware. These links host a password-protected archive file that, when downloaded, installs the DOPLUGS malware on the victim's system. In the course of their investigation, researchers discovered a DOPLUGS variant with an integrated KillSomeOne module, a feature that enables USB-based malware delivery and data exfiltration. This particular variant can be traced back to as early as 2018. The deployment of DOPLUGS was reported by several cybersecurity research firms including Secureworks, Recorded Future, Check Point, and Lab52. The malware's unique RC4 algorithm implementation for PlugX decryption was noted by Lab52 researchers after Taiwanese government and political organizations were targeted. Notably, some DOPLUGS samples were found to include the KillSomeOne module, marking a significant evolution in its functionality. According to a report from Trend Micro, DOPLUGS also features a separate launcher that facilitates DLL sideloading, command execution, and next-stage malware deployment.