0
0
A Chinese hacking group has been attributed to a new campaign aimed at infecting government officials in Europe, the Middle East, and South America with a modular malware known as PlugX.
The intrusions occurred in June and July 2022, once again demonstrating the adversary’s continued focus on espionage against governments around the world.
PlugX is modular malware that contacts a command and control (C2) server for tasking and can download additional plugins to enhance its capability beyond basic information gathering.
Attack chains distribute RAR archive files that contain a Windows shortcut (.LNK) file masquerading as a PDF document, opening which executes a legitimate file present in a nested hidden folder embedded within the archive.
This then paves the way for dropping a decoy document, while the PlugX payload sets up persistence on the infected host.
From The Shadows Emerges Knowledge
