MalwarePublished 25 Feb 2026Updated 27 Mar 2026

The Latest PlugX Variant Executed by STATICPLUGIN

Source AlienVault OTX General

Description

In January 2026, a new variant of the PlugX malware was observed being used in targeted attacks. Analysis suggests involvement of the UNC6384 APT group, linked to Mustang Panda, targeting government agencies in Southeast Asia. The malware uses a browser updater disguise to download and execute a malicious MSI file, leading to PlugX infection. The STATICPLUGIN downloader uses a revoked code-signing certificate from a Chinese company. The PlugX variant employs DLL sideloading and shellcode execution techniques. Its configuration is encrypted using RC4 and custom encoding. C2 servers were identified as fruitbrat[.]com and 108.165.255[.]97:443. The ongoing improvements to PlugX indicate its continued use in targeted attacks by APT groups.

Impact

This PlugX variant poses a significant threat to targeted organizations, especially government agencies in Southeast Asia. Successful infection can lead to unauthorized access, data theft, espionage, and potential disruption of critical government operations. The use of DLL sideloading and shellcode execution increases the malware's stealth and persistence, making detection and removal challenging. The encrypted configuration and use of revoked code-signing certificates complicate forensic analysis and attribution. Organizations compromised by this malware may suffer loss of sensitive information, damage to national security interests, and erosion of trust in their cybersecurity posture. The targeted nature of the attacks suggests a high level of adversary sophistication and intent, increasing the risk of prolonged campaigns and lateral movement within networks. While no widespread outbreaks are reported, the threat remains active and could expand to other sectors or regions if not mitigated effectively.

Defensive guidance

Organizations should implement a multi-layered defense strategy tailored to this threat. First, enforce strict application whitelisting and monitor for unauthorized MSI installations, especially those masquerading as browser updates. Deploy advanced endpoint detection and response (EDR) solutions capable of detecting DLL sideloading and in-memory shellcode execution. Validate all code-signing certificates and block binaries signed with revoked or suspicious certificates. Network defenses should include monitoring and blocking communications to known malicious domains and IP addresses such as fruitbrat.com and 108.165.255.97. Employ network segmentation to limit lateral movement and restrict administrative privileges to reduce attack surface. Regularly update and patch software to close vulnerabilities that could be exploited for initial access. Conduct threat hunting exercises using the provided file hashes and indicators of compromise to identify potential infections. User awareness training should emphasize the risks of executing unsolicited updates or installers. Finally, maintain robust incident response plans to quickly isolate and remediate infections.

Indicators of compromise

Domains 1

fruitbrat.com

URLs 1

http://fruitbrat.com:443

IP addresses 2

45.251.243.210
108.165.255.97

Hashes 12

19c4e403846640def976af31f03105ae
741cda9ec9c8b55eba74a48ecf25e998
9f2445970118960bddeafa3020b5c7f6e07ed53d
b51d16398ac8b3cfd6a24caedd8cddecc4ef3493
106f46375d8497d353c22c98f72ab15a9bb87beba4585d5a492fd11edc288b0b
22014e2d31197dddc2c451ed475aede3d21ca99784973bdcfd9c3a7d9aaa1999
4cd81d26289c4d8383a0ffa34397f0b03941554eac04f1b420269b831accf90e
4ee6bd5a5701853402a08640f531e1be937d0c1f497e3fc255c9ea3e943ecf42
79af67ed343bc45b6a19e4836ebb83f1130243ff98f48465f9a7a807ba4bfa91
a7161c9a7c54a47d27459655725d2ade242d0931d6272c75a36f07df45220b08

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 25 Feb 2026, 12:10 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details