What is PlugX malware?

PlugX is a modular remote access trojan (RAT) that gives an attacker covert, long-term control over a compromised Windows system. Active since around 2008, it is one of the most enduring tools in China-nexus cyber espionage and has been used by many different threat groups. It is best known for a plugin-based design that lets operators load only the capabilities they need, and for using DLL side-loading, in which a legitimate program is tricked into loading the malware, to install and hide itself. PlugX is also tracked under other names, including Korplug, SOGU, and Kaba. As a RAT, PlugX is the tool an attacker uses after breaking in, to maintain access, explore a network, and steal data, rather than the method of initial compromise. This entry explains what PlugX is, how it works, what it can do, who uses it, how it has evolved, and how organizations detect and defend against it, drawing in part on first-party research by Sekoia's Threat Detection & Research (TDR) team, which sinkholed a global PlugX botnet.

Key takeaways

PlugX is a modular remote access trojan, giving attackers covert, long-term control of compromised Windows systems since around 2008.
It is a China-nexus espionage tool. It has been used by numerous Chinese state-linked groups, and its builder has been shared across many of them.
Its signature technique is DLL side-loading. A legitimate signed program is abused to load the malicious code, helping PlugX blend in and evade detection.
Its plugins provide full backdoor control. Operators can run commands, browse and steal files, log keystrokes, capture the screen, and manage processes and services.
It keeps evolving. New variants continue to appear, including a self-spreading USB worm version, keeping PlugX relevant more than fifteen years on.

How PlugX works

PlugX is best understood in two parts: how it gets loaded onto a system, and what it does once running. Its loading method is its most recognizable trait.

PlugX is almost always installed using DLL side-loading. This involves three files delivered together: a legitimate, often digitally signed program; a malicious DLL named so the program loads it automatically; and an encrypted data file containing the actual PlugX code. When the legitimate program runs, it loads the malicious DLL, which in turn decrypts and runs the PlugX payload directly in memory. Because the visible process is a trusted, signed application, this technique helps PlugX evade security tools that judge software by its reputation. This three-file loading pattern has stayed remarkably consistent across more than a decade of PlugX versions.

Once running, PlugX operates as a modular backdoor. Rather than being one large program with every feature built in, it loads plugins that each add a capability, so operators enable only what a given intrusion needs. It then establishes persistence, so it survives a reboot, and calls back to a command-and-control (C2) server to await instructions. Its core capabilities are below.

Capability	What it allows the operator to do
Remote command execution	Run arbitrary commands on the compromised system.
File operations	Browse the file system, and upload, download, and steal files.
Keylogging & screen capture	Record keystrokes and capture screenshots to gather credentials and information.
Process & service control	List, start, and stop processes and system services, and manage the host.
System reconnaissance	Collect information about the machine and its environment to guide further activity.

Communication with the C2 is typically encrypted, and different variants implement different subsets of these commands. This modular, encrypted design is a large part of why PlugX has remained effective and hard to detect for so long.

Who uses PlugX

PlugX is strongly associated with China-nexus cyber espionage. It is understood to have been developed originally by a Chinese programmer, and its builder, the tool used to generate customized samples, was shared across a range of intrusion sets, many of them linked to Chinese state interests. Over the years, groups reported to have used PlugX include Mustang Panda (also tracked as TA416 and RedDelta), APT10, APT41, APT27, and Naikon, among others.

Because the builder was shared and, by some accounts, its code circulated more widely, PlugX is not tied to a single actor. This makes it less useful for attribution than a tool used by only one group, and means its appearance signals a likely China-nexus espionage operation without, on its own, identifying which one. PlugX is also considered a predecessor to more advanced modular tools such as ShadowPad, which some groups adopted while others continued to use PlugX.

How PlugX has evolved

Few malware families have stayed in use as long as PlugX. Its operators have steadily updated it to keep pace with defenses: refining its encryption, changing which legitimate programs it abuses for side-loading, adjusting its configuration format, and adding capabilities such as keylogging plugins. Recent campaigns have continued to deploy new PlugX variants against government, telecommunications, and other strategic targets, sometimes alongside other backdoors.

One of the most significant evolutions came in 2020, when operators associated with Mustang Panda added a self-spreading component that turns PlugX into a worm capable of infecting USB flash drives. This variant can cross air-gapped networks by hiding on removable media and infecting new machines automatically when an infected drive is plugged in, allowing it to reach systems that are not connected to the internet. This USB-worm version became so widespread that it spread beyond its operators' control, a story covered in more depth on the dedicated PlugX worm glossary entry and in Sekoia's first-party research below.

Sekoia's research on PlugX

Sekoia's TDR team carried out widely cited first-party research on the PlugX USB worm. In September 2023, after the worm variant had been documented by other researchers, Sekoia took ownership of the single command-and-control IP address that thousands of infected machines were still contacting, a technique known as sinkholing, for a nominal sum. What the team found was striking: although the operators had long since abandoned the botnet, roughly ninety to one hundred thousand unique IP addresses were still beaconing to it every day, across more than 170 countries, years after the campaign began.

By analyzing the worm's encrypted communications, Sekoia determined that it was possible to send a self-deletion command to the infected machines, and proposed a concept of sovereign disinfection: rather than issuing a blanket removal command worldwide, which raises legal and technical risks, Sekoia offered national cybersecurity agencies and law-enforcement bodies the ability to clean infections within their own countries. This work, and the follow-up on the disinfection campaign, is a clear example of turning deep first-hand analysis of a threat into a concrete benefit for defenders, and it underlines a practical point: a dormant botnet is not a harmless one, because anyone who gains control of that infrastructure could repurpose the still-infected machines.

How to detect and defend against PlugX

Because PlugX relies on abusing legitimate software and modular plugins rather than a single fixed signature, defending against it emphasizes behavior over static detection:

Watch for DLL side-loading. Monitor for legitimate, signed programs loading unexpected DLLs from unusual locations, and for unusual parent-child process relationships, which are hallmarks of how PlugX loads.
Detect the backdoor behavior. Look for encrypted-blob files written to disk, persistence entries such as new registry run keys, and non-browser applications making outbound connections on web ports, which can reveal C2 activity.
Control removable media. Because a PlugX worm variant spreads via USB, apply policies that block execution from removable drives or disable removable storage where it is not needed, especially in sensitive or air-gapped environments.
Harden against initial access. Since PlugX is deployed after a compromise, defending the entry points, through phishing awareness and prompt patching of internet-facing systems, prevents it from being installed in the first place.
Use threat intelligence and behavioral detection. Because PlugX has many variants and users, tracking its known behaviors, loaders, and infrastructure, and hunting for behavior rather than fixed indicators, helps teams recognize it across campaigns.

Expert insight: A fifteen-year-old tool that still works

The most useful lesson in PlugX is its longevity. A backdoor first seen around 2008 is still infecting machines in over 170 countries, still being updated, and still deployed in current espionage campaigns. That endurance is not because PlugX is unusually advanced, but because its core ideas, loading through a trusted signed program and splitting functionality into encrypted, on-demand plugins, are hard to catch with detection that looks for known-bad files. The visible process is legitimate, and the malicious logic lives in memory and in encrypted blobs.

This is where a behavior-focused, intelligence-led approach earns its place, and where Sekoia's own work on PlugX is instructive. Sekoia is a European cybersecurity vendor whose in-house TDR team has researched PlugX directly, to the point of sinkholing one of its global botnets, and that intelligence feeds the platform. Rather than relying only on recognizing a specific PlugX sample, Sekoia's AI SOC platform correlates signals across endpoint, network, and other sources and maps them to the MITRE ATT&CK framework, so that the behaviors behind PlugX, a signed program side-loading an unexpected DLL, a new persistence key, an encrypted callback from an unusual process, are recognized together as an intrusion even when the specific files are new. Sekoia's sinkhole research is an example of turning first-hand intelligence into something defenders and national agencies can act on.

The practical takeaway for defenders is that a tool as adaptable and widely shared as PlugX is caught by understanding behavior and context, not by matching a list of known samples. The decisive questions are behavioral: why is this signed application loading that DLL, why did it just create a persistence entry, and why is it calling out to an unfamiliar server. Answering them depends on visibility across the environment, read against current intelligence on how PlugX operates.