PlugY

PlugY is a type of malware, or malicious software, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. Our analysis of samples of the PlugY implant and the DRBControl backdoor revealed that these two samples have the exact same architecture. This suggests a potential link between the two, as they might be developed or used by the same threat actors. The PlugY implant is delivered using the CloudSorcerer backdoor, which launches a process named msiexec.exe for each user signed into the OS and creates named pipes with the name template \.\PIPE\Y. This implant uses a unique malicious library to communicate with its command and control (C2) server via UDP. It supports multiple commands and uses three different protocols for C2 communications, making it a versatile tool in the hands of attackers. Recent attacks have seen this malware deployed alongside other tools such as the GrewApacha Backdoor in a campaign known as EastWind, targeting Russian government and IT organizations. The adversary has been using the CloudSorcerer backdoor to manually download PlugY, an implant with code that overlaps with APT27, indicating a possible connection with this Advanced Persistent Threat group. This overlap and the use of previously undetected malware underscore the sophistication and ongoing evolution of these cyber threats.