PLUGX is a remote access tool (RAT) used in targeted attacks aimed toward government-related institutions and key industries. It was utilized the same way as Poison Ivy, a RAT involved in a campaign dating back to 2008.

PLUGX allows remote users to perform malicious and data theft routines on a system without the user’s permission or authorization. These malicious routines include:

• Copying, creating, modifying, and opening files
• Logging keystrokes and active windows
• Logging off the current user, restarting/rebooting the affected system
• Creating, modifying and/or deleting registry values
• Capturing video or screenshots of user activity
• Setting connections
• Terminating processes

Apart from compromising system security, PLUGX’s routines could lead to further information theft if systems are left unchecked. PLUGX also gives attackers complete control over the system.

For further information on BKDR_PLUGX variants that we have already detected, click here.

BKDR_PLUGX: INFECTION CHAIN and LAYERED SOLUTION

Click image to enlarge.

Pattern Versions and Release Dates