plugx - 采样包下载平台 loop采样下载 音频采样下载 serum preset下载 massive preset下载 spire preset下载 sylenth preset下载 合成器preset下载

2025年1月16日 · PlugX has been around since at least 2008 but is under constant development. With the remote access it provides criminals, it is often used to spy on users and plant additional malware on interesting systems.

2023年1月27日 · Security researchers have analyzed a variant of the PlugX malware that can hide malicious files on removable USB devices and then infect the Windows hosts they connect to. The malware uses what...

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups. [1] [2] [3] [4] PlugX can be configured to use HTTP for command and control. [4] [7] PlugX can be configured to use DNS for command and control. [4] PlugX adds Run key entries in the Registry to establish persistence. [1] [8] [6]

PlugX is a modular malware with multiple capabilities. It calls back to a command and control (C2) server, gathers machine information, performs screen captures, and manages services and processes. Additionally, it looks to obfuscate its activities by performing actions like modifying the characteristics of folders to hide them.

2023年1月26日 · PlugX is a second-stage implant used not only by multiple groups with a Chinese nexus but also by several cybercrime groups. It has been around for over a decade and has been observed in some high-profile cyberattacks, including the U.S. Government Office of Personnel Management (OPM) breach in 2015.

2025年1月15日 · According to court documents unsealed in the Eastern District of Pennsylvania, the Beijing-linked hackers used a version of PlugX malware to infect, control, and steal information from victim computers.

2025年1月14日 · The U.S. Department of Justice announced today that the FBI has deleted Chinese PlugX malware from over 4,200 computers in networks across the United States.

2024年4月30日 · 研究人员发现了 PlugX 恶意软件 变体的命令和控制服务器，并在六个月内观察到来自唯一 IP 地址的连接超过 250 万个。 自去年 9 月以来，Sinkhole 服务器每天收到来自 170 多个国家受感染主机的 90,000 多个请求。 自 2023 年 9 月Sekoia捕获与特定 C2 相关的唯一 IP 地址以来，它已记录了来自 170 个国家/地区的超过 2,495,297 个与其 Sinkhole 交互的唯一 IP。 这一行动使安全公司能够分析流量、绘制感染地图、防止对客户端的恶意利用，并制定有效的消毒计划 …

2024年4月26日 · 网络安全公司Sekoia的研究人员仅以7美元的价格购买了一个不再被威胁行为者使用的PlugX恶意软件变种的C2服务器相对应的IP地址45.142.166 [.]112。 该C2 IP地址在2023年3月Sophos发布的一份报告中有所记录，报告提到PlugX的新版本已经传播到了"几乎相距半个地球的地方"。 并且，该恶意软件已经具备了通过 USB 设备自我传播的能力。 在Seqoia与托管公司联系并请求控制该IP后，研究人员获得了使用该IP服务器的shell访问权限。 为模仿原C2服务器的行 …