Attacks on East Asia using Google Code for Command and Control
Summary: Unit 42 found seven PlugX samples using Google Code project pages for command and control, five of which were not in VirusTotal before submission, in attacks between early June and early July against an international law firm's regional office and a major university in East Asia. The samples were signed with legitimate certificates from PixelPlus Co., Ltd, QTI International Inc and Ssanyong Motor Co., Ltd, and three Google Code projects on the newly uncovered account were added within days of the research, indicating active use.
Why it matters: The malware sat on legitimate Google Code pages and carried valid third-party certificates, and individual samples were detected by as few as two to four AV vendors, so reputation and signature checks alone would have missed them.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026