Tag: staticplugin

2 Attack Reports | 0 Vulnerabilities

Attack reports

The Latest PlugX Variant Executed by STATICPLUGIN

In January 2026, a new variant of the PlugX malware was observed being used in targeted attacks. Analysis suggests involvement of the UNC6384 APT group, linked to Mustang Panda, targeting government agencies in Southeast Asia. The malware uses a browser updater disguise to download and execute a ma…
apt
plugx
valleyrat
dll-sideloading
code-signing
targeted-attack
staticplugin
2026-02-25
rc4-encryption
Published: February 25, 2026
Downloadable IOCs: 11

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

A sophisticated cyber espionage campaign attributed to the PRC-nexus threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The attack chain involved hijacking web traffic through a captive portal redirect to deliver malware disguised as software updates. The multi-sta…
espionage
social engineering
in-memory execution
2025-08-26
prc-nexus
canonstager
sogu.sec
digital signatures
staticplugin
captive portal
Published: August 26, 2025
Downloadable IOCs: 9
Click here to see more Attack Reports