Article
Software Shared Across ATT&CK Groups: Reuse Study
MITRE ATT&CK v19.2 data: Mimikatz is linked to 51 of 176 groups, while 503 of 607 software entries tie to one group. See the…
Read more
Malware profile
PlugX
Also known as Thoper, TVT, DestroyRAT
PlugX is a remote access tool for Windows, built from plugins.
In short
PlugX is a remote access tool for Windows, built from plugins. It lets an operator run commands, capture screens and keystrokes, and move files on an infected computer. MITRE lists many threat groups that have used it, and the FBI has observed it since at least 2012.
- Names8names in public reportsPlugX · Thoper · TVT
- Techniques18ATT&CK techniques listedExecution · Persistence · Stealth
- Infection Steps6in the delivery chainThree files arrive · Harmless program starts
- Linked Groups3groups that use itMustang Panda · APT41 · menuPass
In one minute
- What it is
- PlugX is a remote access tool for Windows, built from plugins. It is also called Korplug, Sogu, Thoper, TVT, DestroyRAT and Kaba.
- What it does
- It lets an operator open a shell, run files, record keystrokes, take screenshots, list files and move data off the machine, while hiding in memory.
- Who uses it
- Attributed by the FBI (court affidavit, December 2024) to Mustang Panda for one variant. MITRE lists many more groups.
- How it gets in
- A file made to look like a normal document, or, for one variant the FBI describes, an infected USB drive.
- What to do first
- Allow programs to run only from trusted folders, and watch for web traffic on port 443 that is not real SSL.
What it does
PlugX is built from plugins, so an operator can choose which functions to run. CISA’s 2017 analysis says the plugins can be added, removed or updated while the tool is running, and that the modules differ between variants. In the sample CISA studied, plugins covered files, keystrokes, screenshots, processes, the registry, services, a remote shell, SQL queries and a Telnet interface.
CISA also reported that PlugX is never stored on disk in an unencrypted or decoded form. In a court affidavit the FBI says PlugX has infected thousands of Windows computers worldwide and that owners of infected computers are typically unaware of it.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| PlugX | MITRE ATT&CK software page S0013[1] |
| Thoper | MITRE Associated Software[1] |
| TVT | MITRE Associated Software[1] |
| DestroyRAT | MITRE Associated Software[1] |
| Sogu | MITRE Associated Software[1] |
| Kaba | MITRE Associated Software[1] |
| Korplug | MITRE Associated Software[1] |
| PLUGX/SOGU | CISA alert TA17-117A[3] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Execution
Persistence
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001
It adds Run key entries in the registry so it starts again with the computer.[1]
Create or Modify System Process: Windows Service T1543.003
It can be installed as a service, and has a module to change, start, control and delete services.[1]
Scheduled Task/Job: Scheduled Task T1053.005
It has created a scheduled task to run more malicious software and to stay on the machine.[1]
Stealth
Hijack Execution Flow: DLL T1574.001
It starts by DLL search order hijacking or by side-loading a malicious DLL through a signed program.[1]
Reflective Code Loading T1620
It loads its payload into memory instead of leaving it readable on disk.[1]
Masquerading: Match Legitimate Resource Name or Location T1036.005
It has been disguised as Adobe and PotPlayer files and copies the names of real software folders and files.[1]
Indicator Removal: File Deletion T1070.004
It can remove itself and other files it created.[1]
Collection
Command And Control
Application Layer Protocol: Web Protocols T1071.001
It can be set up to talk to its server over HTTP, and has also used HTTPS.[1]
Non-Application Layer Protocol T1095
It can be set up to use raw TCP or UDP for command and control.[1]
Ingress Tool Transfer T1105
A module downloads files to the machine and runs them.[1]
Encrypted Channel: Symmetric Cryptography T1573.001
It can use RC4 encryption in its command and control traffic.[1]
Exfiltration
How it spreads
MITRE says PlugX has used a first file made to look like a normal document so the target opens it, and has copied itself to infected removable drives to reach other devices. The FBI describes one variant that spreads through a computer's USB port, infecting attached USB devices and then potentially other Windows computers they are later plugged into. In the 2017 CISA alert, where PlugX was one of the malware seen, CISA says the main way in was user impersonation with compromised credentials, and that malware implants were a secondary way to stay in the network.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Three files arrive
PlugX typically installs from three parts: a harmless program, a malicious DLL and an encoded payload.[3]
Harmless program starts
The program is launched. It sits in a folder not normally linked to it, and may be signed with a valid certificate.[3]
Malicious DLL loads
The DLL has the name of one the program normally loads, so it is loaded in its place. It decodes and installs the payload.[3]
Payload runs in memory
The payload is unpacked in memory and the operator has command and control of the computer.[3]
Staying on the machine
In the variant the FBI describes, registry keys start PlugX again when the computer starts.[2]
Contact with the server
In that variant, PlugX can ask its hard-coded command server for instructions when the computer is online.[2]
Timeline
- 2012
- 2014
State-sponsored use
The FBI affidavit says China-based state-sponsored hackers have used PlugX since at least 2014.[2]
- 27 April 2017
CISA alert TA17-117A
CISA posts an alert on a campaign running since at least May 2016, in which PLUGX/SOGU was among the malware observed.[3]
- 20 December 2018
Alert updated with attribution
CISA updates the alert with the US Government's attribution of the activity it covers to Chinese cyber actors associated with the Chinese Ministry of State Security.[3]
- July 2023
RedDelta campaign begins
MITRE dates the start of a Mustang Panda campaign built around a modified PlugX infection chain, which ran to December 2024.[5]
- September 2023
Contacts with FBI-observed server begin
The FBI says at least 45,000 US IP addresses have contacted the command server of one PlugX variant since this month.[2]
- 28 August 2024
First warrant
The affidavit says the warrant to remove PlugX from US computers was first issued on this date and reissued on a rolling basis.[2]
- 17 December 2024
Thousands cleaned
The affidavit says the self-delete command had been sent to thousands of unique IP addresses by this date, and asks for another 14-day warrant.[2]
- 11 January 2025
End of delayed notice
The FBI asked the court to delay notice of the warrant until this date.[2]
Who uses it
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
- Threat group menuPass Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers. China · Since 2006
- Threat group Mustang Panda MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. China · Since 2012
Detection and defense
Questions
What is PlugX?
MITRE describes it as a remote access tool with modular plugins that has been used by multiple threat groups. It runs on Windows.
Who uses PlugX?
MITRE lists many groups, including Mustang Panda, APT41 and menuPass. The FBI affidavit says it assesses Mustang Panda is the user of the variant it targeted.
How does PlugX spread?
MITRE says it has copied itself to removable drives. The FBI describes a variant that spreads through USB devices to other Windows computers.
Did the FBI remove PlugX from computers?
The FBI affidavit describes a court-authorized command, sent through a French law enforcement agency's access to the command server, that made PlugX delete itself. By 17 December 2024 it had been sent to thousands of unique IP addresses.
How does PlugX hide?
CISA says it runs through DLL side-loading, is unpacked in memory and is never stored on disk in decoded form.
In our research
- Software Shared Across ATT&CK Groups: Reuse Study October 2026
- LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors February 2026
- APT27 January 2026
- GALLIUM APT: What MITRE ATT&CK Says December 2025
- APT41: China’s Dual-Purpose Cyber Powerhouse November 2025
- EASM Best Practices for the Energy Sector October 2025
Sources
- PlugX, Software S0013 MITRE ATT&CKSupports: Names, platform, techniques, groups and campaign for PlugX
- Affidavit in support of an application for a ninth search and seizure warrant (PlugX) U.S. Department of Justice, FBISupports: USB spread, command server, self-delete command, Mustang Panda assessment, dates
- Intrusions Affecting Multiple Victims Across Multiple Sectors (TA17-117A) CISASupports: PlugX plugin framework, DLL side-loading, signatures, mitigations, 2018 attribution update
- Mustang Panda, Group G0129 MITRE ATT&CKSupports: Associated names including Twill Typhoon
- RedDelta Modified PlugX Infection Chain Operations, Campaign C0047 MITRE ATT&CKSupports: Mustang Panda campaign, July 2023 to December 2024
- menuPass, Group G0045 MITRE ATT&CKSupports: menuPass and its alias APT10
- APT41, Group G0096 MITRE ATT&CKSupports: APT41 use of a PlugX variant
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.