Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

PKPLUG: Chinese Cyber Espionage Group Attacking Southeast Asia

Summary: Unit 42 has tracked cyber espionage campaigns across Asia for three years under the moniker PKPLUG, named for the tactic of delivering PlugX malware inside ZIP archives whose headers carry the ASCII bytes "PK" as part of a DLL side-loading package. The group or groups also use custom payloads including HenBox, an Android app, and Farseer, a Windows backdoor, plus the 9002 Trojan, Poison Ivy and Zupdax, with victims mainly in Myanmar, Taiwan, Vietnam and Indonesia and likely also Tibet, Xinjiang and Mongolia.

Bottom line: Unit 42 assesses with high confidence that PKPLUG has origins similar to Chinese nation-state adversaries, and its activity spans six years or more, with HenBox samples dating back to late 2015 and targeting Uyghur users while harvesting calls to +86 numbers and accessing device microphones and cameras.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related