Backdoor:Win32/Korplug has been observed to employ PlugX—a remote access trojan (RAT) that has been active since 2008. It allows attackers to gain unauthorized remote control over compromised systems, enabling them to execute a wide range of malicious activities.
It is primarily used by various advanced persistent threat (APT) groups, including APT 22, APT 26, and APT41, among others. PlugX, also known as Destroy RAT, Kaba, Korplug, and several other aliases, allows attackers to gain unauthorized remote control over compromised systems, enabling them to execute a wide range of malicious activities.
As a backdoor, it provides attackers with extensive capabilities, such as retrieving system information, capturing screenshots, keylogging, and managing system processes and services. Its adaptability and design make it a persistent threat, capable of evolving to bypass traditional security measures.
In addition, its ability to maintain a low profile and log its activities makes detection and mitigation efforts more complicated.
One of PlugX’s main tricks is called DLL side-loading, meaning it disguises itself as a legitimate program and “piggybacks” on trusted software to run unnoticed. For example, attackers may pair PlugX with real debugging tools like x32dbg.exe. Because the malicious file runs inside a trusted program, security tools and users are less likely to suspect foul play.
Once inside, PlugX connects back to the attackers through command-and-control (C2) servers over standard internet channels like HTTP or HTTPS. To stay under the radar, it disguises this communication using ordinary-looking file names or user agent strings (which normally describe a browser or app). Through this connection, attackers can issue remote commands, such as gathering system details, taking screenshots, or controlling system processes, without the user’s knowledge.
PlugX is built to survive on a system for as long as possible:
- Persistence mechanisms: It alters Windows registry settings, creates scheduled tasks, and leaves behind activity logs to re-establish itself after reboots.
- Hidden storage: The malware can also hide files on USB drives, making them invisible to Windows users but accessible to attackers using specialized tools or non-Windows systems.
- Stealth techniques: These measures help PlugX remain active while avoiding detection, allowing attackers to quietly monitor and manipulate the compromised system over time.
Backdoor:Win32/Korplug creates the following files:
- C:\Program Files (x86)\Common Files\BDinit.exe
The malware also creates the following processes:
- C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\readme.dll"
- C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- C:\Users\user\Desktop\readme.dll,LogApplySettings
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,LogEnable
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,LogInit
- "C:\Program Files (x86)\Common Files\BDinit.exe"
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogApplySettings
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogEnable
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogInit
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogWrite
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogUninitDeskMetrics
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogTrackEventData
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogTrackEvent
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogSetType
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogSetSettingsFile
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogSetPath
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogSetMode
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogSetMaxSize
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogSetLevel
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",LogSetDepth
- C:\Windows\SysWOW64\rundll32.exe rundll32.exe
- "C:\Users\user\Desktop\readme.dll",LogIsEnabled
Guidance for Individual users
Keep your operating system and antivirus products up to date. Customers who have turned on automatic updates do not need to take additional action
Take these steps to help prevent malware infection on your computer.
Guidance for enterprise administrators and Microsoft 365 Defender customers
Ransomware more than often attacks enterprises than individuals. Following the below mitigation steps can help prevent ransomware attacks.
Microsoft recommends the following mitigations to reduce the impact of activity.
