Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Chinese PlugX Malware Hidden in Your USB Devices?

Summary: Unit 42's incident response team found an older PlugX variant during a Black Basta breach response, alongside GootLoader and Brute Ratel C4, and it infects any attached removable USB media and any systems the drive is later plugged into. The malware hides its files using the Unicode no-break space character 00A0 so Windows Explorer and cmd.exe cannot display them, and a second variant found in VirusTotal copies all Adobe PDF and Microsoft Word files from the host into a hidden USB folder named da520e5.

What's compelling: PlugX has been in use for over a decade by multiple Chinese-nexus groups and cybercrime groups, and was seen in the 2015 OPM breach; the x32bridge.dat payload had a VirusTotal detection score of eight out of 61 engines as of Dec. 15, 2022, with none identifying it as PlugX.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026