Top Tweets for #Plugx
Sample is now on VT!
🚩Hash: 5adae26409c6576f95270ce9ca3877df3ee60849c18540fd92c0c9c974ba2f6d
🎯Actor name: Unknown CN-APT
🔹Comment: On March 1, 2026, ThreatLabz observed new activity from a China-nexus threat actor targeting countries in the Persian Gulf region. The activity took place within the first 24 hours of the renewed conflict in the Middle East. The threat actor quickly weap
🌐URL: https://t.co/vedJKYooNn
🔎OnVT: https://t.co/ikKFHMJHkv
Interesting sample from Vieatnam,
Zip: 32391ce6eca836369cfd5b3948ba978b7982dd3a85b81bb33c973773adeaef01
Tin_buồn_PGĐ_Công_ty.pdf.lnk : 5b798cf328c17ecd6a2e759c9adc695b068640226f0d4fae049bcb6470d4ae56
@smica83 @skocherhan @malwrhunterteam @ElementalX2
Interesting sample from Vieatnam,
Zip: 32391ce6eca836369cfd5b3948ba978b7982dd3a85b81bb33c973773adeaef01
Tin_buồn_PGĐ_Công_ty.pdf.lnk : 5b798cf328c17ecd6a2e759c9adc695b068640226f0d4fae049bcb6470d4ae56
@smica83 @skocherhan @malwrhunterteam @ElementalX2
#Fofa Query for #MustangPanda /#StatelyTaurus #APT Infra (Most likely #PlugX / #ToneShell Variant)
#Query: cert.subject[.cn=="localhost" && header="HTTP/1.1 426 Upgrade Required" && server=="Python/3.12 websockets/11.0.3"
#Link: https://t.co/nPPAb1onAn
Infra (from Jan-2026):
----------------
103.247.19[.]204:443
194.5.97[.]169:443
195.66.213[.]170:443
154.196.139[.]38:443
188.208.141[.]177:443
102.211.234[.]105:443
2.59.216[.]250:443
176.97.117[.]5:443
103.245.164[.]154:443
194.59.183[.]133:443
146.70.29[.]241:443
188.208.141[.]177:443
103.175.50[.]32:443
103.114.203[.]75:443
38.54.42[.]106:443
185.9.17[.]213:443
45.89.105[.]83:443
@500mk500 #Malware #ioc #APT #RAT
![Cyberteam008's tweet photo. #Fofa Query for #MustangPanda /#StatelyTaurus #APT Infra (Most likely #PlugX / #ToneShell Variant)
#Query: cert.subject[.cn=="localhost" && header="HTTP/1.1 426 Upgrade Required" && server=="Python/3.12 websockets/11.0.3"
#Link: https://t.co/nPPAb1onAn
Infra (from Jan-2026):
----------------
103.247.19[.]204:443
194.5.97[.]169:443
195.66.213[.]170:443
154.196.139[.]38:443
188.208.141[.]177:443
102.211.234[.]105:443
2.59.216[.]250:443
176.97.117[.]5:443
103.245.164[.]154:443
194.59.183[.]133:443
146.70.29[.]241:443
188.208.141[.]177:443
103.175.50[.]32:443
103.114.203[.]75:443
38.54.42[.]106:443
185.9.17[.]213:443
45.89.105[.]83:443
@500mk500 #Malware #ioc #APT #RAT](https://pbs.twimg.com/media/HMmI8hQbgAA535b.jpg)
![Cyberteam008's tweet photo. #Fofa Query for #MustangPanda /#StatelyTaurus #APT Infra (Most likely #PlugX / #ToneShell Variant)
#Query: cert.subject[.cn=="localhost" && header="HTTP/1.1 426 Upgrade Required" && server=="Python/3.12 websockets/11.0.3"
#Link: https://t.co/nPPAb1onAn
Infra (from Jan-2026):
----------------
103.247.19[.]204:443
194.5.97[.]169:443
195.66.213[.]170:443
154.196.139[.]38:443
188.208.141[.]177:443
102.211.234[.]105:443
2.59.216[.]250:443
176.97.117[.]5:443
103.245.164[.]154:443
194.59.183[.]133:443
146.70.29[.]241:443
188.208.141[.]177:443
103.175.50[.]32:443
103.114.203[.]75:443
38.54.42[.]106:443
185.9.17[.]213:443
45.89.105[.]83:443
@500mk500 #Malware #ioc #APT #RAT](https://pbs.twimg.com/media/HMmI0fCaoAAOctX.jpg)
Canon.dat #PlugX
SHA256: c74d70892fc2193790bedc8c08539b390ea460bc0ef72cb568568943016c35f0
C2: 202.61.72[.]198:443 (FUD)
![mopisec's tweet photo. Canon.dat #PlugX
SHA256: c74d70892fc2193790bedc8c08539b390ea460bc0ef72cb568568943016c35f0
C2: 202.61.72[.]198:443 (FUD) https://t.co/FQdElFNKod](https://pbs.twimg.com/media/HLe5tmcbcAAZGOd.png)
11b81750c87168ff3e96f1228f86e031
#PlugX
TA416 (#MustangPanda) continues to target Mongolia 🇲🇳 with cyber espionage activity.
They are deploying #PlugX via a multi-stage SVG smuggling technique. The initial SVG contains heavily obfuscated layers that eventually trigger "ZIP smuggling" to drop the malicious archive.
The SVG payload was completely FUD (0/61 on VirusTotal).
IOCs:
🔹 SVG MD5: df78df95a79f3f764a6da9638624e4a0
🔹 ZIP MD5: 20063941491e5727cb2cbf824c656294 (previously noted by @smica83)
#ThreatIntel #MalwareAnalysis #APT
We've just published a complete technical analysis of #PlugX (#KorPlug), a modular RAT delivered through an MSI-based DLL sideloading chain abusing a legitimate G DATA binary. The report covers the full infection chain, control-flow flattening obfuscation, encrypted payload staging, reflective DLL loading, RC4 configuration decryption, C2 communication, and persistence mechanisms.
Read the full analysis here: https://t.co/5zCu8GMDzD
#darkatlas #PlugX #Malware_Analysis
We've just published a complete technical analysis of #PlugX (#KorPlug), a modular RAT delivered through an MSI-based DLL sideloading chain abusing a legitimate G DATA binary. The report covers the full infection chain, control-flow flattening obfuscation, encrypted payload staging, reflective DLL loading, RC4 configuration decryption, C2 communication, and persistence mechanisms.
Read the full analysis here: https://t.co/5zCu8GMDzD
#darkatlas #PlugX #Malware_Analysis
Last Seen Hashtags on Sotwe
同志小视频
teenageer
Seen from Chile
nik tunis
momsonn
Seen from Chile
vgk bocil
Seen from Singapore
เย็ดดุ
Seen from Thailand
incest little sister
Seen from United Kingdom
momsonn momsonn filter:videos since:2026-08-11
Seen from United States
Bagginshield
Seen from United States
นนทบุรี
Seen from Thailand
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.8M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.2M followers
Virat Kohli
@imvkohli
73M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers