THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group
Summary: Unit 42 researchers found a PlugX variant, dubbed THOR, delivered as a post-exploitation RAT to a Microsoft Exchange Server compromised on March 19, 2021 through the ProxyLogon zero-day chain (CVE-2021-26855 and CVE-2021-27065) from IP 101.36.120[.]227. The variant replaces PlugX's trademark "PLUG" magic number (0x504C5547) with "THOR" (0x54484F52), and the earliest sample found dates to August 2019.
Why it matters: PlugX has been in use since 2008 and was used in the 2015 OPM breach, and this rebranded build still points at the same C2 domain, rainydaysweb[.]com, as a traditional PLUG sample first seen the same day - so signature checks on the old magic number would have missed it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2021-26855CVE-2021-27065
- Related
- Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·