Uptime Hamster: 112d 13h 15mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza PKPLUG

PKPLUG

0 incidentes 0 paises 0 sectores apt CN Ultimo: -
Aliases: APT PKPLUG
Ver en IntelTracker → APTTrail →
PKPLUG is a Chinese cyber espionage group that first emerged in November 2013, primarily conducting long-term intelligence gathering operations, with a focus on targets within Southeast Asia. The group is characterized by its strategic patience, maintaining persistent access within compromised networks for extended durations, and its consistent use of DLL side-loading techniques to deploy a blend of custom malware, such as HenBox for Android and Farseer for Windows, alongside publicly available tools like PlugX. This group is also recognized by the aliases Mustang Panda and HoneyMyte.

Aliases del actor

APT PKPLUG

Actores similares

apt-pkplugactor · 1apt-c-01actor · 2apt-c-27actor · 2apt-45actor · 2apt-c-37actor · 1apt-c-23actor · 1hellsing-aptactor · 1apt-c-44actor · 1apt-c-38actor · 1apt-c-12actor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

TipoEstadoHost / enlaceTitle / ultimo titulo
Webunknowncommunity.emergingthreats.netAPT PKPLUG indicators and references
Webunknownotx.alienvault.comAPT PKPLUG indicators and references
Webunknownpan-unit42.github.ioAPT PKPLUG indicators and references
Webunknownunit42.paloaltonetworks.comAPT PKPLUG indicators and references
Webunknownunit42.paloaltonetworks.comAPT PKPLUG indicators and references
Webunknownunit42.paloaltonetworks.comAPT PKPLUG indicators and references
Repositoriounknowngithub.comAPT PKPLUG indicators and references
Webunknownraw.githubusercontent.comAPT PKPLUG indicators and references
Webunknowncommunity.emergingthreats.netAPT PKPLUG indicators and references
Motivacion
Information theft and espionage
Malware asociado
PlugX, PlugX, ShadowPad, PoisonIvy, Mimikatz, PlugX
Tecnicas MITRE
T1005 - Data from Local System, T1566.001, T1047, T1574.005, T1588.002, T1115 - Clipboard Data
CVEs relacionadas
CVE-2026-24858, CVE-2025-8088, CVE-2025-64328, CVE-2025-59719, CVE-2025-59718, CVE-2025-55182
Tipo
apt
Pais origen
CN
Motivacion
Information theft and espionage
Impacto
84
Actualizado
Sat, 11 Ma

Paises objetivo (OSINT)

ArgentinaChinaUnited KingdomIndonesiaIndiaJapanLiberiaMyanmarMongoliaMalaysia

Sectores objetivo (OSINT)

Software PublishersHospitalsManufacturingPublic AdministrationEducational ServicesData Processing ServicesSpace & DefenseInsurancePharmaceutical and Medicine ManufacturingPlastics Product Manufacturing