software

PlugX

activeentity:software

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: plugx
kind: software
status: active
aliases: DestroyRAT · Kaba · Korplug · Sogu · Thoper · TVT
jurisdictions: —
claims naming it: 0 · 0 attributions · 15 relations · 0 events

Identifiers

attack S0013via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatGALLIUMusesPlugX
fetch —sha256 dc1639caa5501d72
rel_27btcintel:relations:27@v1 sha256:f610d561c4158790
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT3usesPlugX
fetch —sha256 dc1639caa5501d72
rel_32btcintel:relations:32@v1 sha256:e55634a107b0955e
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT41usesPlugX
fetch —sha256 dc1639caa5501d72
rel_66btcintel:relations:66@v1 sha256:d2ba7fb62e789f5f
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatmenuPassusesPlugX
fetch —sha256 dc1639caa5501d72
rel_96btcintel:relations:96@v1 sha256:6240bacfada2321d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatMUSTANG PANDAusesPlugX
fetch —sha256 dc1639caa5501d72
rel_212btcintel:relations:212@v1 sha256:c1856381d24f69d4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatHigaisausesPlugX
fetch —sha256 dc1639caa5501d72
rel_276btcintel:relations:276@v1 sha256:ee4330bcc3f4b0c8
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA459usesPlugX
fetch —sha256 dc1639caa5501d72
rel_295btcintel:relations:295@v1 sha256:085ad1135d13edcf
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatCinnamon TempestusesPlugX
fetch —sha256 dc1639caa5501d72
rel_422btcintel:relations:422@v1 sha256:e018586fe82e52bb
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAxiomusesPlugX
fetch —sha256 dc1639caa5501d72
rel_455btcintel:relations:455@v1 sha256:02abd2b26b35e031
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLuminousMothusesPlugX
fetch —sha256 dc1639caa5501d72
rel_482btcintel:relations:482@v1 sha256:ab179cd826b162d3
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatWinnti GroupusesPlugX
fetch —sha256 dc1639caa5501d72
rel_540btcintel:relations:540@v1 sha256:4e5eb3fbbee7468c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatVelvet AntusesPlugX
fetch —sha256 dc1639caa5501d72
rel_597btcintel:relations:597@v1 sha256:d3c3b5cdb5c7f06a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatDragonOKusesPlugX
fetch —sha256 dc1639caa5501d72
rel_624btcintel:relations:624@v1 sha256:f91054fedcda4f1f
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatDaggerflyusesPlugX
fetch —sha256 dc1639caa5501d72
rel_625btcintel:relations:625@v1 sha256:ff0abb4b089706be
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatThreat Group-3390usesPlugX
fetch —sha256 dc1639caa5501d72
rel_643btcintel:relations:643@v1 sha256:babacf4b9fd5ec78
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.