PKPLUG
PKPLUG is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Civil Society and NGOs sector in 3 countries, including Indonesia and Taiwan. It uses 11 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 11
- Exploited CVEs
- No CVE data
- First seen
- Oct 3, 2019
- Last seen
- Oct 3, 2019
- Record updated
Who They Target.
Sectors · 1
Countries · 3
How They Operate · MITRE ATT&CK.
11 techniques across 6 of 14 tacticsReconnaissance·
Resource Development·
Initial Access3
T1203
Exploitation for Client Execution
Exploitation for Client Execution
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution4
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
T1218
System Binary Proxy Execution
System Binary Proxy Execution
T1574.002
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: DLL Side-Loading
Persistence1
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion1
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Masquerading: Match Legitimate Resource Name or Location
Credential Access·
Discovery1
T1125
Video Capture
Video Capture
Lateral Movement·
Collection1
T1123
Audio Capture
Audio Capture
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- 9002malware
- Farseermalware
- HenBoxmalware
- PlugXmalware
- PoisonIvymalware
- Zupdaxmalware
- PowerSploittool
Campaigns.
- FHAPPI CampaignOct 2019
Indicators Of Compromise.
TLP:AMBER6 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout PKPLUG.
A Chinese cyber espionage threat actor cluster operating across Asia since at least 2013, characterized by the delivery of PlugX and other custom and shared payloads via DLL side-loading packages inside ZIP archives.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.