PlugX

Kaspersky researchers identified two new backdoors, OctLurk and SilkLurk, used in a coordinated cyber-espionage campaign against government organizations in Central Asia since January 2025. OctLurk deploys via scheduled tasks and Windows services using a loader that decrypts its payload using the victim's C: drive serial number, while SilkLurk uses DLL side-loading of legitimate NVIDIA and Realtek binaries and decrypts payloads using the victim's computer name. Both backdoors support in-memory plugin loading for command shells, file management, keyboard/mouse simulation, and credential theft, with the actor also deploying LurkProxy for network traffic proxying, PlugX as a secondary RAT, and various post-exploitation tools including Impacket secretsdump, keyloggers, and browser password stealers.

A China-nexus threat actor, assessed with medium confidence to be Mustang Panda, conducted a multi-stage attack campaign targeting the Arabian Gulf region using Middle East conflict-themed social engineering lures. The attack chain delivered a PlugX backdoor variant through a ZIP archive containing a malicious LNK file that downloaded a CHM file via cURL, extracted a TAR archive using hh.exe, and used DLL sideloading to execute heavily obfuscated shellcode. The PlugX variant supports HTTPS and DNS-over-HTTPS (DOH) for C2 communication and employs advanced obfuscation including control flow flattening, mixed boolean arithmetic, corrupted MZ/PE headers, and reflective DLL injection.

SentinelLABS identified sustained cyberespionage activity by suspected China-nexus and India-nexus threat actors against Pakistani law enforcement organizations from February 2024 to April 2026, with both converging on Balochistan Police. Four C2 clusters (PlugX, ShadowPad, Cobalt Strike, Remcos) were mapped to compromised infrastructure. A China-nexus actor compromised the Balochistan Police Complaint Management System (CMS), deploying custom implants (cms_plugin.exe) disguised as portal updates that delivered AsyncRAT and staged payloads from attacker-controlled servers, targeting both police personnel and citizens. The implants share a development environment (D:\codedome PDB prefix) with Chinese-language indicators, attributing them to a Chinese-speaking developer.

The Q1 2026 vulnerability landscape shows a continued rise in overall CVEs and KEVs, with a significant focus on software supply chain compromises and networking gear. A notable emerging threat is the abuse of the n8n AI workflow automation platform to bypass traditional security filters, alongside the discovery of the PowMix botnet targeting Czech workers and ongoing exploitation of legacy vulnerabilities.

A China-nexus threat actor, assessed with medium confidence as Mustang Panda, targeted the Persian Gulf region using a multi-stage attack chain themed around the Middle East conflict. The campaign leverages LNK and CHM files to execute a heavily obfuscated shellcode loader via DLL sideloading, ultimately deploying a PlugX backdoor capable of HTTPS and DNS-over-HTTPS (DoH) C2 communications.

Arctic Wolf Labs has identified a cyber espionage campaign by the Chinese-affiliated threat actor UNC6384 targeting European diplomatic entities. The campaign exploits the ZDI-CAN-25373 Windows shortcut vulnerability to deliver malicious LNK files, ultimately deploying the PlugX RAT via DLL side-loading of legitimate Canon printer utilities.