Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PlugX/SOGU.SEC in-memory deployment via STATICPLUGIN

Malware Activity
First reported
Last updated
Happening score
H score 28
1 unique sources, 2 articles

Summary

Hide ▲

UNC6384 ran at least two related PlugX delivery campaigns in 2025. In March 2025, the China-nexus actor used a captive portal hijack and adversary-in-the-middle (AitM) redirection to push a fake Adobe Plugin update, deliver STATICPLUGIN from mediareleaseupdates[.]com, fetch an MSI package, and use CANONSTAGER with cnmpaui.dll and the Canon IJ Printer Assistant Tool to load SOGU.SEC in memory. In September-October 2025, Arctic Wolf said the group targeted diplomatic and government entities in Hungary, Belgium, Italy, the Netherlands, and Serbia with spear-phishing LNK files abusing ZDI-CAN-25373 / CVE-2025-9491. That chain used PowerShell, a decoy PDF, a TAR archive, CanonStager, and an encrypted payload named cnmplog.dat, while an early-September HTA path fetched payloads from cloudfront[.]net.

Related Happenings

LotusLite backdoor delivered via DLL sideloading

Malware Activity
H score22 First: 21.04.2026 15:00 Last: 21.04.2026 15:00 Sources 1

About this happening: The Mustang Panda campaign spans an April 2026 wave against India's banking sector and US-Korea policy circles and a later June 12–22, 2026 wave against Indi...

Latest development: 29.06.2026 18:03

Acronis observed Mustang Panda campaigns against Indian government and hydropower targets using SHARDLOADER, MINIRECON, and ZOHOMURK, with Zoho WorkDrive abused as a command-and-control and exfiltration channel. The activity involved spear-phishing ZIP archives, DLL sideloading through signed binaries such as Solid PDF Creator and Citrix Receiver, and active beaconing from June 12 to June 22, 2026; Acronis also found active compromises inside Indian government networks and worked with CERT-In on notification and cleanup.

Open Happening

Microsoft silently patches in Windows LNK files remote code execution flaw (CVE-2025-9491)

Vulnerability
H score32 First: 12.02.2026 23:01 Last: 12.02.2026 23:01 Sources 1

How related: It's officially tracked as CVE-2025-9491 (CVSS score: 7.0)

About this happening: Windows LNK shortcut files remain the focus of this vulnerability thread: CVE-2025-9491 / ZDI-CAN-25373 is being used in September-October 2025 spear-phishing atta...

Open Happening

Mustang Panda PlugX DOPLUGS deployment chain for persistent access

Malware Activity
H score26 First: 04.02.2026 16:09 Last: 04.02.2026 16:09 Sources 1

About this happening: Mustang Panda (TA416) used malicious ZIP/LNK chains to deliver its custom PlugX/DOPLUGS payload and maintain persistent access on compromised hosts. The activity t...

Open Happening

WinRAR path-traversal exploitation wave (CVE-2025-8088)

Exploitation Wave
H score20 First: 27.01.2026 21:38 Last: 27.01.2026 21:38 Sources 1

About this happening: CVE-2025-8088 in WinRAR remains an ongoing exploitation wave. Trend Micro says Russia-aligned groups Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-022...

Open Happening

WinRAR path traversal via Alternate Data Streams (CVE-2025-8088)

Vulnerability
H score21 First: 27.01.2026 21:38 Last: 27.01.2026 21:38 Sources 1

About this happening: The CVE-2025-8088 WinRAR path traversal flaw is being actively exploited through Alternate Data Streams (ADS) to write malicious files outside the extraction direc...

Open Happening

Timeline

  1. 31.10.2025 15:57 1 articles · 8mo ago

    UNC6384 targets European diplomatic and government entities with CVE-2025-9491 LNK files

    Campaign Scope Update

    Arctic Wolf said UNC6384 targeted diplomatic organizations in Hungary, Belgium, Italy, and the Netherlands, along with government agencies in Serbia, with spear-phishing emails that delivered malicious LNK files abusing ZDI-CAN-25373/CVE-2025-9491. The chain launched PowerShell to decode and extract a TAR archive, displayed a decoy PDF, sideloaded CanonStager through a legitimate Canon printer assistant utility, and loaded the encrypted PlugX payload cnmplog.dat; an early-September HTA variant also retrieved payloads from cloudfront[.]net.

    Show sources
    Open in new tab
  2. 25.08.2025 21:11 1 articles · 10mo ago

    UNC6384 PlugX delivery chain disclosed

    Initial Disclosure

    Google Threat Intelligence Group disclosed that the China-nexus actor UNC6384 targeted diplomats in Southeast Asia and other entities globally in a March 2025 campaign that used a captive portal hijack, adversary-in-the-middle redirection, and social engineering to deliver the signed downloader STATICPLUGIN from mediareleaseupdates[.]com, retrieve an MSI package, and use CANONSTAGER with cnmpaui.dll and the Canon IJ Printer Assistant Tool to load the PlugX variant SOGU.SEC in memory behind a fake Adobe Plugin update.

    Show sources
    Open in new tab