Korplug

Malware updated 6 months ago (2024-05-25T09:17:32.579Z)

Download STIX

Preview STIX

Korplug, also known as PlugX, is a type of malware developed and utilized by the China-aligned Advanced Persistent Threat (APT) group, Mustang Panda. This malicious software is designed to infiltrate computer systems without detection, often through suspicious downloads, emails, or websites. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. The group has been known to target various Asian countries with a variant of this backdoor malware dubbed DOPLUGS. Notably, on February 22, 2024, Mustang Panda launched another such attack. The Korplug loader, a key component of this malware, was written in Nim, a versatile programming language known for its efficiency and flexibility. Several instances of DLL files infected with variants of the Korplug malware were detected, such as BEE0B741142A9C392E05E0443AAE1FA41EF512D6 HPCustPartUI.dll and AB01E099872A094DC779890171A11764DE8B4360 BoomerangLib.dll, among others. These files are typically used as part of the group's classic trident, a strategy further detailed in a WeLiveSecurity article from March 2022. In addition to deploying Korplug, the attackers also utilized other malware, such as DinodasRAT, according to ESET researchers. This multi-pronged approach suggests a sophisticated operation likely conducted by state-aligned actors. Symantec reported that these downloaders were subsequently used to deploy Korplug, reinforcing the assertion that Mustang Panda was behind these cyber-attacks. As such, organizations are advised to implement robust security measures to protect against such threats.

Description last updated: 2024-05-25T09:15:28.401Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
PlugX is a possible alias for Korplug. PlugX is a Remote Access Trojan (RAT) malware known for its stealthy operations and destructive capabilities. It is often used by threat actors to exploit and damage computer systems, steal personal information, disrupt operations, or hold data hostage for ransom. Its deployment has been linked to s	6
Sogu is a possible alias for Korplug. SOGU is a malicious software (malware) attributed to TEMP.Hex, a threat actor linked to China. The malware is designed to exploit and damage computer systems, often infiltrating them through suspicious downloads, emails, or websites. Once inside, it can steal personal information, disrupt operations	3
Doplugs is a possible alias for Korplug. DOPLUGS is a variant of the PlugX malware, developed and deployed by the China-linked Advanced Persistent Threat (APT) group Mustang Panda. Active since 2022, this unique malware has been used in targeted campaigns against various Asian countries including Taiwan, Vietnam, India, Japan, and China. U	2
Cobra Docguard is a possible alias for Korplug. Cobra DocGuard, a software produced by Chinese firm EsafeNet for protecting, encrypting, and decrypting software, has been exploited in a series of malware attacks. The attackers compromised the software's update files to deliver malicious updates that infected targeted systems. The first known inst	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Backdoor

Malware

Downloader

Apt

Symantec

Implant

Rat

Payload

Loader

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Dinodasrat Malware is associated with Korplug. DinodasRAT is a malicious software that has been causing significant security concerns worldwide. This malware, which targets both Windows and Linux operating systems, is designed to infiltrate your system and perform harmful activities such as stealing personal information, disrupting operations, o	Unspecified	3
The Cobra Malware is associated with Korplug. Cobra is a type of malware, short for malicious software, designed to exploit and damage computer systems or devices. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, Cobra has the potential to steal personal information, disrup	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Mustang Panda Threat Actor is associated with Korplug. Mustang Panda, a China-aligned Advanced Persistent Threat (APT) group, has been identified as a significant cyber threat actor involved in a series of malicious activities. Notably, Mustang Panda was found to be associated with the BRONZE PRESIDENT phishing lure, which delivered PlugX and used modif	Unspecified	2

Source Document References

Information about the Korplug Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
ESET	6 months ago	Introducing Nimfilt: A reverse-engineering tool for Nim-compiled binaries
CERT-EU	a year ago	US lawmakers want China export bans to include open source
CERT-EU	9 months ago	New Mustang Panda campaign targets Asia with a backdoor dubbed DOPLUGS
Securityaffairs	9 months ago	New Mustang Panda campaign targets Asia with a backdoor dubbed DOPLUGS
CERT-EU	2 years ago	MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT \| WeLiveSecurity
CERT-EU	2 years ago	Space Pirates: analyzing the tools and connections of a new hacker group
CERT-EU	2 years ago	PlugX Trojan Disguised as Legitimate Windows Debugger Tool in Latest Attacks \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware - National Cyber Security
BankInfoSecurity	a year ago	Breach Roundup: IT Worker Sentenced for Impersonation
Checkpoint	a year ago	9th October – Threat Intelligence Report - Check Point Research
CERT-EU	a year ago	New Red Cross hacktivism guidelines derided by threat actors
CERT-EU	a year ago	Guyana government subjected to suspected Chinese cyberespionage campaign
CERT-EU	a year ago	More sophisticated state-backed hacks emerge amid cyberespionage shift
BankInfoSecurity	a year ago	China-Linked APT Uses New Backdoor for Espionage in Guyana
CERT-EU	a year ago	'Operation Jacana' Reveals DinodasRAT Custom Backdoor
CERT-EU	a year ago	Operation Jacana: They’re taking the hobbits to Guyana
MITRE	2 years ago	Exchange servers under siege from at least 10 APT groups \| WeLiveSecurity
Securityaffairs	2 years ago	MQsTTang, a new backdoor used by Mustang Panda APT
Count Upon Security	2 years ago	Threat Hunting in the Enterprise with AppCompatProcessor
Count Upon Security	2 years ago	Malware Analysis – PlugX
Securityaffairs	a year ago	Carderbee APT targets Hong Kong orgs via supply chain attacks