Campaign DetailSource-backed corpus

PLUGX/SOGU Multi-Victim Intrusions

CISA documented multi-victim intrusions in which stolen local and domain administrator credentials, certificates, impersonation, and trusted IT-service-provider relationships were primary access mechanisms. PLUGX/SOGU was used as a secondary remote-access implant on relay and staging systems through a legitimate executable, malicious DLL, and encoded payload that decoded in memory.

Last updated Aug 06, 2026, 12:00 PM EDT

Actor Mapping

Mapped Threat Actors

Stone Panda APT10 menuPassOther PlugX-family operators

Targeting

Target Sectors / Countries

Managed Service ProvidersTechnologyGovernmentHealthcareEnergyCommunicationsManufacturingProfessional Services

Tradecraft

ATT&CK / Techniques

T1078T1199T1574.001T1620T1021T1003T1053.005T1543.003

Tools / Observables

Malware, Tools, CVEs

Privileged logons from anomalous infrastructurecertificate or account impersonationprovider-to-client accesslegitimate executable plus unexpected DLL plus encoded data filememory-resident PlugX/SOGUscheduled task or Windows service persistenceHTTP Cookie-based command-and-control in sample-specific reporting

Campaign Chronology

Observed Activity Timeline

2014–2015
Unit 42 samples
Malicious Office documents exploiting CVE-2012-0158 delivered a Samsung-based three-file PlugX loader chain.
May 2016–April 2017
CISA multi-victim intrusions
CISA observed credential, certificate, impersonation, and provider-trust access with PLUGX/SOGU on relay and staging systems.
December 2018
APT10 charges
DOJ charged two alleged APT10 members and described MSP and technology-theft campaigns; allegations are historical attribution context.
2019–2020
Separate Cicada/APT10 campaign
Symantec documented Japan-linked activity and a tool capable of exploiting CVE-2020-1472; this is not proof of SOGU delivery.

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

PlugX is used by multiple operators. CVE-2012-0158 is tied to specific Unit 42 delivery samples; CVE-2013-3906 is historical shared-infrastructure context only; CVE-2020-1472 appeared in a separate APT10/Cicada campaign and is not an inherent SOGU vulnerability.

Evidence Controls

Methodology / Claim Status

Reporting period: Sample reporting from 2014–2015; CISA campaign window May 2016–April 2017; later actor context through 2020
Methodology: Cross-source synthesis of government alerts, ATT&CK records, legal attribution, and primary malware/campaign research
Sample scope: CISA multi-victim intrusion set plus explicitly separated sample- and campaign-specific context
Claim status: Campaign mechanics confirmed; actor exclusivity, local compromise, and vulnerability use require case-specific evidence

IntelliOS

Related Intel Products

PANDA Flash Threat Intel BriefSOGU Flash Threat BriefThe 32-card investigation, evidence, and response brief.CARDS ActorStone Panda / APT10Historical actor context; not exclusive attribution for this malware family.CARDS KEV/CVECVE-2012-0158Known-exploited vulnerability tied to specific PlugX delivery samples.CARDS KEV/CVECVE-2013-3906Historical shared-infrastructure context only.CARDS KEV/CVECVE-2020-1472Separate APT10/Cicada campaign context; not a SOGU prerequisite.

Citations

Source Trust / Citations

[1] CISA: Intrusions Affecting Multiple Victims Across Multiple SectorsCISA / US-CERT
[2] MITRE ATT&CK: PlugX (S0013)MITRE ATT&CK
[3] MITRE ATT&CK: menuPass (G0045)MITRE ATT&CK
[4] DOJ: APT10 global intrusion campaignsU.S. Department of Justice
[5] Symantec: Cicada/APT10 Japan-linked campaignSymantec / Broadcom
[6] Unit 42: PlugX Samsung DLL side-loading samplesPalo Alto Networks Unit 42
[7] Trend Micro: Operation DRBControlTrend Micro

Loading Threat Actor Cards