PlugX
Software · ATTACK:enterprise:S0013
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0013",
"title": "PlugX",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0013",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--64fa0de0-6240-41f4-8638-f4ca7ed528fd",
"external_id": "S0013",
"domain": "enterprise",
"created": "2017-05-31T21:32:15.638Z",
"modified": "2026-05-12T15:12:00.734Z",
"version": "3.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "DestroyRAT"
},
{
"source_name": "Kaba"
},
{
"source_name": "PlugX"
},
{
"source_name": "Korplug"
},
{
"source_name": "Sogu"
},
{
"source_name": "Thoper"
},
{
"source_name": "TVT"
},
{
"source_name": "CIRCL PlugX March 2013",
"url": "http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"
},
{
"source_name": "Dell TG-3390",
"url": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
},
{
"source_name": "New DragonOK",
"url": "http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"
},
{
"source_name": "Novetta-Axiom",
"url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
},
{
"source_name": "FireEye Clandestine Fox Part 2",
"url": "https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"
},
{
"source_name": "Lastline PlugX Analysis",
"url": "https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"
}
]
}Explicit source assertions (65)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--006104e8-1188-4fcf-b0b0-c7a7131bcdad
Sygnia VelvetAnt 2024AATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0644d7f4-edb2-4fbf-81bb-498d1962ad4e
Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--067ece2b-4e66-437f-88e0-8dc3f076331b
Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07702379-2d40-48ae-a077-d68e0da5e4be
Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024 · Proofpoint TA416 Europe March 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bb197ea-3530-4cd5-861a-26ef8bb1f6f9
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d989c2e-0207-4412-b52a-5d9bf9f96d18
FireEye APT10 April 2017ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c45410-f606-4f0b-86b9-ee0447447b1f
Symantec Daggerfly 2023ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca27813-cdc2-4d3c-a3db-d18f1de9c697
DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e66dafa-3cf0-4f21-85e0-a9fa9827aaa1
Eset PlugX Korplug Mustang Panda March 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fac9041-e22d-417b-8951-8ad63f62b6fa
Eset PlugX Korplug Mustang Panda March 2022 · DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22af1cbd-a7fd-4d9f-ba15-d640c217603e
FireEye APT41 Aug 2019 · apt41_mandiantATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--234205d5-cc99-435c-bbc8-e2c1d3eb0ac5
Eset PlugX Korplug Mustang Panda March 2022 · Proofpoint TA416 Europe March 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98
Eset PlugX Korplug Mustang Panda March 2022 · Dell TG-3390ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · EclecticIQ Mustang Panda PlugXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30437ed1-5cad-4656-9ae8-c4a06122b613
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3427863f-d4c4-4272-ad60-1479e42ed4af
FireEye Clandestine Fox Part 2ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38f209df-bb69-4971-bbd8-db5a54bbf217
CIRCL PlugX March 2013ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d97f57c-2a7c-4626-8b05-9d345047d3ad
Palo Alto PlugX June 2017ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4032bd86-db32-4270-98a4-670be6992802
Malwarebytes Higaisa 2020ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--412b7fbf-bc21-4373-9f2c-5f0a26482536
SecureWorks BRONZE UNION June 2017 · Dell TG-3390 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020 · Nccgroup Emissary Panda May 2018ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44de6f93-f752-41cd-9372-0e0280c51ee9
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a5302f7-b953-4d4b-b080-6f3d5d4da00e
Eset PlugX Korplug Mustang Panda March 2022 · EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Sophos PlugX September 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8
CIRCL PlugX March 2013ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e
Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · Lastline PlugX AnalysisATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d2c6d2c-f2ae-4447-8ba7-53250207ace2
Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a
Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Dell TG-3390 · EclecticIQ Mustang Panda PlugX · Profero APT27 December 2020 · Palo Alto PlugX June 2017 · Trend Micro DRBControl February 2020 · PWC Cloud Hopper Technical Annex April 2017 · Proofpoint TA416 Europe March 2022 · FireEye Clandestine Fox Part 2 · Sophos PlugX September 2022 · Sophos Mustang Panda PLUGX · Stewart 2014ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b271a21-d91f-489b-b6a1-b223a9094df5
Cybereason Soft Cell June 2019ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cd5efff-11d4-4ab0-839b-b277b3f1b98b
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e
Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ee26367-1517-4fda-9dbe-8f9e63cc01eb
Cisco Group 72 · Novetta-AxiomATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1127.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--652af94a-7ff3-4d47-89e5-154c7bc34258
Palo Alto PlugX June 2017ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68487d82-458b-4f45-b1c8-c6e4affaa226
FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017 · DOJ APT10 Dec 2018ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bf4098c-7667-44df-bdaa-076b9099f851
Eset PlugX Korplug Mustang Panda March 2022 · Dell TG-3390 · EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Proofpoint TA416 Europe March 2022ATTACK:enterprise:G0062 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e763ef9-94cb-4244-bea8-86e6d19bfb71
Proofpoint TA459 April 2017ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71485f5d-f685-403d-a0da-72acbae0f79e
Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--754790a1-86b9-4421-b8e9-84d3dee51097
CIRCL PlugX March 2013 · FireEye APT10 April 2017 · Proofpoint ZeroT Feb 2017 · PWC Cloud Hopper Technical Annex April 2017 · Lastline PlugX AnalysisATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79106ad4-28d3-4f67-a2c3-116d138ec84a
Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · Dell TG-3390 · EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Sophos PlugX September 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c8e34ad-89a4-44cf-bd56-d1583803f086
CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024 · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 · Proofpoint TA416 Europe March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80e9ec9c-ecb4-48c3-944c-e318fec4a656
Sygnia VelvetAnt 2024AATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83ea392a-3959-4b29-b7b8-517a20ec836d
DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86b00142-a259-4237-b1a8-a8183d581b54
Unit42 PlugX June 2017ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b020cdd-4731-4dd5-8407-7f3076ab1d2d
CIRCL PlugX March 2013ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e824b6e-a0b7-4a57-9a7e-89b2c390beec
Eset PlugX Korplug Mustang Panda March 2022 · EclecticIQ Mustang Panda PlugX · Proofpoint TA416 Europe March 2022 · Sophos PlugX September 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:C0047 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e9798ed-5cb1-4997-9701-d6adefc1bdab
Recorded Future RedDelta 2025ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a29d9514-3284-4ac2-a93a-e17750519534
Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024 · EclecticIQ Mustang Panda PlugX · PWC Cloud Hopper Technical Annex April 2017 · Sophos Mustang Panda PLUGX · Lastline PlugX AnalysisATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abea6903-7e77-456d-acb6-22f6a7af8087
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c
Dell TG-3390ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b896fe24-1ada-47ac-9780-10c9b0785e34
Eset PlugX Korplug Mustang Panda March 2022 · DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c
CIRCL PlugX March 2013ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb9e291c-4464-41e2-97b7-e19ce9169118
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c420d58d-2a7e-4eef-a12d-d37e4c9fc9b4
Eset PlugX Korplug Mustang Panda March 2022 · Proofpoint TA416 Europe March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253
Sygnia VelvetAnt 2024AATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1027.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--caaf6cc0-1d43-483a-a0c7-938610d98f48
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0
Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CIRCL PlugX March 2013 · EclecticIQ Mustang Panda PlugX · Trend Micro DRBControl February 2020 · Proofpoint TA416 Europe March 2022 · Sophos Mustang Panda PLUGXATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf75bbf8-f88c-4277-b486-3bab9901c0c2
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1c69dc2-dce7-4f6e-a725-03aa8356b54d
DOJ Affidavit Search and Seizure PlugX December 2024ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7fa6787-4b79-44cf-986e-558a5c7b2aac
DOJ Affidavit Search and Seizure PlugX December 2024 · Sophos PlugX September 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--deafd60c-af1a-40eb-bc43-287b37553fae
Eset PlugX Korplug Mustang Panda March 2022 · Proofpoint TA416 Europe March 2022 · Lastline PlugX AnalysisATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e809f78f-344d-4169-a145-89023f4530d5
Trend Micro DRBControl February 2020 · Proofpoint TA416 Europe March 2022ATTACK:enterprise:G0017 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee2739de-6829-4c73-b72b-91ba4b9fac5c
New DragonOKATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f85073cb-7f45-4145-8923-58450af3451f
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:G0044 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9911b03-f413-483b-b228-f5a82657c2d1
Kaspersky Winnti April 2013ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc7c27b4-e18f-486a-b7f8-9eb61eec23f2
Eset PlugX Korplug Mustang Panda March 2022 · Anomali MUSTANG PANDA October 2019 · Secureworks BRONZE PRESIDENT December 2019 · EclecticIQ Mustang Panda PlugX · Avira Mustang Panda January 2020 · Recorded Future REDDELTA July 2020 · Crowdstrike MUSTANG PANDA June 2018 · Proofpoint TA416 Europe March 2022 · Sophos PlugX September 2022