type: malware
spec_version: 2.1
id: malware--64fa0de0-6240-41f4-8638-f4ca7ed528fd
created: 2017-05-31T21:32:15.638Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0013
external_id: S0013
source_name: DestroyRAT
description: (Citation: CIRCL PlugX March 2013)
source_name: Kaba
description: (Citation: FireEye Clandestine Fox Part 2)
source_name: PlugX
description: (Citation: Lastline PlugX Analysis) (Citation: FireEye Clandestine Fox Part 2)(Citation: CIRCL PlugX March 2013)
source_name: Korplug
description: (Citation: Lastline PlugX Analysis)(Citation: CIRCL PlugX March 2013)
source_name: Sogu
description: (Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: CIRCL PlugX March 2013)
source_name: Thoper
description: (Citation: Novetta-Axiom)
source_name: TVT
description: (Citation: Novetta-Axiom)
source_name: CIRCL PlugX March 2013
description: Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
url: http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf
source_name: Dell TG-3390
description: Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
url: https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
source_name: New DragonOK
description: Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.
url: http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/
source_name: Novetta-Axiom
description: Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
url: https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
source_name: FireEye Clandestine Fox Part 2
description: Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.
url: https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html
source_name: Lastline PlugX Analysis
description: Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
url: https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-09-11T18:28:54.041Z
name: PlugX
description: [PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 3.2
x_mitre_attack_spec_version: 3.3.0
x_mitre_aliases: PlugX
Thoper
TVT
DestroyRAT
Sogu
Kaba
Korplug