How Rainy Day, Turian and a new PlugX variant abuse DLL search order hijacking
Summary: Cisco Talos identified an ongoing campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries, assessed with medium confidence as the work of Naikon, a Chinese-speaking threat actor active since 2010. RainyDay, Turian and a newly identified PlugX variant all abused the same legitimate Mobile Popup Application via DLL search order hijacking, and their loaders share an XOR decryption function and the same RC4 keys.
Key Takeaway: Two groups Talos tracks separately, Naikon and BackdoorDiplomacy, reuse the same RC4 keys and loader code, which suggests the same or connected operators running multiple malware families at once - so treating them as distinct adversaries may understate the exposure.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026