November 6, 2023

How PlugX Malware Has Evolved & Adapted

Discover how Darktrace effectively detected and thwarted the PlugX remote access trojan in 2023 despite its highly evasive and adaptive nature.

Written by

Nahisha Nobregas

SOC Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Nahisha Nobregas

SOC Analyst

Nov 2023

What is PlugX Remote Access Trojan?

Understanding remote access trojans (RATs)

As malicious actors across the threat landscape continue to pursue more efficient and effective ways of compromising target networks, all while remaining undetected by security measures, it is unsurprising to see an increase in the use of remote access trojans (RATs) in recent years. RATs typically operate stealthily, evading security tools while offering threat actors remote control over infected devices, allowing attackers to execute a wide range of malicious activities like data theft or installing additional malware.

Definition and general functionality of RATs: A Remote Access Trojan (RAT) is a type of malware that enables unauthorized remote control of an infected computer. Once installed, RATs allow attackers to monitor user activities, steal sensitive information, manipulate files, and execute commands. RATs are typically distributed via phishing emails, malicious attachments, drive-by downloads, or exploiting software vulnerabilities. Due to their ability to provide comprehensive control over a compromised system, RATs pose a significant security threat to individuals and organizations.

Historical overview of PlugX

PlugX is one such example of a RAT that has attributed to Chinese threat actors such as Mustang Panda, since it first appeared in the wild back in 2008. It is known for its use in espionage, a modular and plug-in style approach to malware development. It has the ability to evolve with the latest tactics, techniques, and procedures (TTPs) that allow it to avoid the detection of traditional security tools as it implants itself target devices.

How does PlugX work?

The ultimate goal of any RAT is to remotely control affected devices with a wide range of capabilities, which in PlugX’s case has typically included rebooting systems, keylogging, managing critical system processes, and file upload/downloads. One technique PlugX heavily relies on is dynamic-link library (DLL) sideloading to infiltrate devices. This technique involves executing a malicious payload that is embedded within a benign executable found in a data link library (DLL) [1]. The embedded payload within the DLL is often encrypted or obfuscated to prevent detection.

What’s more, a new variant of PlugX was observed in the wild across Papua New Guinea, Ghana, Mongolia, Zimbabwe, and Nigeria in August 2022, that added several new capabilities to its toolbox.

Key capabilities of PlugX

The new variation is reported to continuously monitor affected environments for new USB devices to infect, allowing it to spread further through compromised networks [2]. It is then able to hide malicious files within a USB device by using a novel technique that prevents them from being viewed on Windows operating systems (OS). These hidden files can only be viewed on a Unix-like (.nix) OS, or by analyzing an affected USB devices with a forensic tool [2]. The new PlugX variant also has the ability to create a hidden directory, “RECYCLER.BIN”, containing a collection of stolen documents, likely in preparation for exfiltration via its command and control (C2) channels. [3]

Since December 2022, PlugX has been observed targeting networks in Europe through malware delivery via HTML smuggling campaigns, a technique that has been dubbed SmugX [4].

This evasive tactic allows threat actors to prepare and deploy malware via phishing campaigns by exploiting legitimate HTML5 and JavaScript features [5].

Darktrace Coverage of PlugX

Between January and March 2023, Darktrace observed activity relating to the PlugX RAT on multiple customers across the fleet. While PlugX’s TTPs may have bypassed traditional security tools, the anomaly-based detection capabilities of Darktrace allowed it to identify and alert the subtle deviations in the behavior of affected devices, while Darktrace was able to take immediate mitigative action against such anomalous activity and stop attackers in their tracks.

C2 Communication

Between January and March 2023, Darktrace detected multiple suspicious connections related to the PlugX RAT within customer environments. When a device has been infected, it will typically communicate through C2 infrastructure established for the PlugX RAT. In most cases observed by Darktrace, affected devices exhibited suspicious C2 connections to rare endpoints that were assessed with moderate to high confidence to be linked to PlugX.

On the network of one Darktrace customer the observed communication was a mix of successful and unsuccessful connections at a high volume to rare endpoints on ports such as 110, 443, 5938, and 80. These ports are commonly associated with POP3, HTTPS, TeamViewer RDP / DynGate, and HTTP, respectively. Figure 1 below showcases this pattern of activity.

Figure 1: Model Breach Event Log demonstrating various successful and unsuccessful connections to the PlugX C2 endpoint 103.56.53[.]46 via various destination ports.

On another customer’s network, Darktrace observed C2 communication involving multiple failed connection attempts to another rare external endpoint associated with PlugX. The device in this case was detected attempting connections to the endpoint, 45.142.166[.]112 on ports 110, 80, and 443 which caused the DETECT model ‘Anomalous Connection / Multiple Failed Connections to Rare Endpoint’ to breach. This model examines devices attempting connections to a rare external endpoint over a short period of time, and it breached in response to almost all PlugX C2 related activity detected by Darktrace. This highlights Darktrace DETECT’s unique ability to identify anomalous activity which appears benign or uncertain, rather than relying on traditional signature-based detections.

Figure 2: Device Event Log demonstrating various successful and unsuccessful connections to the PlugX C2 endpoint 45.142.166[.]112 via various destination on January 27, 2023.

New User Agent

Darktrace's Self-Learning AI approach to threat detection also allowed it to recognize connections to PlugX associated endpoints that utilized a new user agent. In almost all connections to PlugX endpoints detected by Darktrace, the same user agent, Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36, was observed, illustrating a clear pattern in PlugX-related activity

In one example from February 2023, an affected device successfully connected to an endpoint associated with PlugX, 45.142.166[.]112, while using the aforementioned new user agent, as depicted in Figure 3.

Figure 3: The Device Event log above showcases a successful connection to the PlugX associated IP address, 45.142.166[.]112 using the new user agent ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’.

On March 21, 2023, Darktrace observed similar activity on a separate customer’s network affected by connections to PlugX. This activity included connections to the same endpoint, 45.142.166[.]112. The connection was an HTTP POST request made via proxy with the same new user agent, ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’. When investigated further this user agent actually reveals very little about itself and appears to be missing a couple of common features that are typically contained in a user agent string, such as a web browser and its version or the mention of Safari before its build ID (‘537.36’).

Additionally, for this connection the URI observed consisted of a random string of 8 hexadecimal characters, namely ‘d819f07a’. This is a technique often used by malware to communicate with its C2 servers, while evading the detection of signature-based detection tools. Darktrace, however, recognized that this external connection to an endpoint with no hostname constituted anomalous behavior, and could have been indicative of a threat actor communicating with malicious infrastructure, thus the ‘Anomalous Connection / Possible Callback URI’ model was breached.

Figure 4: An affected device was detected using the new user agent, ‘Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36’ while connecting to the rare external endpoint 45.142.166[.]112 via proxy.

Numeric File Download

Darktrace’s detection of PlugX activity on another customer’s network, in February 2023, helped to demonstrate related patterns of activity within the C2 communication and tooling attack phases. Observed PlugX activity on this network followed the subsequent pattern; a connection to a PlugX endpoints is made, followed by a HTTP POST request to a numeric URI with a random string of 8 hexadecimal characters, as previously highlighted. Darktrace identified that this activity represented unusual ‘New Activity’ for this device, and thus treated it with suspicion.

Figure 5: New activity was identified by Darktrace in the Device Event Log shown above for connections to the endpoint 45.142.166[.]112 followed by HTTP POSTs to URIs “/8891431c” and “/ba12b866” on February 15, 2023.

The device in question continued to connect to the endpoint and make HTTP POST connections to various URIs relating to PlugX. Additionally, the user agent `Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36` was again detected for these connections. Figure 6 details the activity captured by Darktrace’s Cyber AI Analyst.

Figure 6: The image above showcases activity captured by Darktrace’s AI Analyst for PlugX connections made on February 15, 2023.

Darktrace detected that during these connections, the device in question attempted to download a suspicious file named only with numbers. The use of numeric file names is a technique often used by threat actors to obfuscate the download of malicious files or programs and bypass traditional security tools. Darktrace understood that the download of a numeric file, coupled with the use of an anomalous new user agent, mean the incident should be treated with suspicion. Fortunately, Darktrace RESPOND was enabled in autonomous response mode during this attack, meaning it was able to automatically block the device from downloading the file, or any other files, from the suspicious external location for a two-hour period, potentially preventing the download of PlugX’s malicious tooling.

Conclusion

Amid the continued evolution of PlugX from an espionage tool to a more widely available malware, it is essential that threat detection does not rely on a set of characteristics or indicators, but rather is focused on anomalies. Throughout these cases, Darktrace demonstrated the efficacy of its detection and alerting on emerging activity pertaining to a particularly stealthy and versatile RAT. Over the years, PlugX has continually looked to evolve and survive in the ever-changing threat landscape by adapting new capabilities and TTPs through which it can infect a system and spread to new devices without being noticed by security teams and their tools.

However, Darktrace’s Self-Learning AI allows it to gain a strong understanding of customer networks, learning what constitutes expected network behavior which in turn allows it to recognize the subtle deviations indicative of an ongoing compromise.

Darktrace’s ability to identify emerging threats through anomaly-based detection, rather than relying on established threat intelligence, uniquely positions it to detect and respond to highly adaptable and dynamic threats, like the PlugX malware, regardless of how it may evolve in the future.

Credit to: Nahisha Nobregas, SOC Analyst & Dylan Hinz, Cyber Analyst

Appendices

MITRE ATT&CK Framework

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell

Persistence and Privilege Escalation

T1547.001 Boot or Logon AutoStart Execution: Registry Run Keys / Startup Folder
T1574.001 Hijack Execution Flow: DLL Search Order Hijacking
T1574.002 Hijack Execution Flow: DLL Side-Loading
T1543.003 Create or Modify System Process: Windows Service
T1140 Deobfuscate / Decode Files or Information
T1083 File and Directory Discovery

Defense Evasion

T1564.001 Hide Artifacts: Hidden Files and Directories
T1036.004 Masquerading: Task or Service
T1036.005 Masquerading: Match Legitimate Name or Location
T1027.006 Obfuscated Files or Information: HTML Smuggling

Credential Access

T1056.001 Input Capture: Keylogging

Collection

T1105 Ingress Tool Transfer

Command and Control

T1573.001 Encrypted Channel: Symmetric Cryptography
T1070.003 Mail Protocols
T1071.001 Web Protocol

DETECT Model Breaches

Anomalous Connection / Multiple Failed Connections to Rare Endpoint
Anomalous Connection / New User Agent to IP Without Hostname
Anomalous File / New User Agent Followed By Numeric File Download
Anomalous Connection / Possible Callback URL

Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence

45.142.166[.]112 - IP - PlugX C2 Endpoint / moderate - high

103.56.53[.]46 - IP - PlugX C2 Endpoint / moderate - high

Mozilla/5.0 (Windows NT 10.0;Win64;x64)AppleWebKit/537.36 - User Agent - PlugX User Agent / moderate – high

/8891431c - URI - PlugX URI / moderate-high

/ba12b866 - URI - PlugX URI / moderate -high

References

1. https://www.crowdstrike.com/blog/dll-side-loading-how-to-combat-threat-actor-evasion-techniques/

2. https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/

3. https://news.sophos.com/en-us/2023/03/09/border-hopping-plugx-usb-worm/

4. https://thehackernews.com/2023/07/chinese-hackers-use-html-smuggling-to.html

5. https://www.cyfirma.com/outofband/html-smuggling-a-stealthier-approach-to-deliver-malware/

Written by

Nahisha Nobregas

SOC Analyst

Inside the SOC

Written by

Nahisha Nobregas

SOC Analyst

Senior Product Marketing Manager, Email

Watch the NIS2 Webinar

Blog

Network

June 27, 2025

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

login on laptop dual factor authentication

What is Blind Eagle?

Since 2018, APT-C-36, also known as Blind Eagle, has been observed performing cyber-attacks targeting various sectors across multiple countries in Latin America, with a particular focus on Colombian organizations.

Blind Eagle characteristically targets government institutions, financial organizations, and critical infrastructure [1][2].

Attacks carried out by Blind Eagle actors typically start with a phishing email and the group have been observed utilizing various Remote Access Trojans (RAT) variants, which often have in-built methods for hiding command-and-control (C2) traffic from detection [3].

What we know about Blind Eagle from a recent campaign

Since November 2024, Blind Eagle actors have been conducting an ongoing campaign targeting Colombian organizations [1].

In this campaign, threat actors have been observed using phishing emails to deliver malicious URL links to targeted recipients, similar to the way threat actors have previously been observed exploiting CVE-2024-43451, a vulnerability in Microsoft Windows that allows the disclosure of a user’s NTLMv2 password hash upon minimal interaction with a malicious file [4].

Despite Microsoft patching this vulnerability in November 2024 [1][4], Blind Eagle actors have continued to exploit the minimal interaction mechanism, though no longer with the intent of harvesting NTLMv2 password hashes. Instead, phishing emails are sent to targets containing a malicious URL which, when clicked, initiates the download of a malicious file. This file is then triggered by minimal user interaction.

Clicking on the file triggers a WebDAV request, with a connection being made over HTTP port 80 using the user agent ‘Microsoft-WebDAV-MiniRedir/10.0.19044’. WebDAV is a transmission protocol which allows files or complete directories to be made available through the internet, and to be transmitted to devices [5]. The next stage payload is then downloaded via another WebDAV request and malware is executed on the target device.

Attackers are notified when a recipient downloads the malicious files they send, providing an insight into potential targets [1].

Darktrace’s coverage of Blind Eagle

In late February 2025, Darktrace observed activity assessed with medium confidence to be associated with Blind Eagle on the network of a customer in Colombia.

Within a period of just five hours, Darktrace / NETWORK detected a device being redirected through a rare external location, downloading multiple executable files, and ultimately exfiltrating data from the customer’s environment.

Since the customer did not have Darktrace’s Autonomous Response capability enabled on their network, no actions were taken to contain the compromise, allowing it to escalate until the customer’s security team responded to the alerts provided by Darktrace.

Darktrace observed a device on the customer’s network being directed over HTTP to a rare external IP, namely 62[.]60[.]226[.]112, which had never previously been seen in this customer’s environment and was geolocated in Germany. Multiple open-source intelligence (OSINT) providers have since linked this endpoint with phishing and malware campaigns [9].

The device then proceeded to download the executable file hxxp://62[.]60[.]226[.]112/file/3601_2042.exe.

Figure 1: Darktrace’s detection of the affected device connecting to an unusual location based in Germany.

Figure 2: Darktrace’s detection of the affected device downloading an executable file from the suspicious endpoint.

The device was then observed making unusual connections to the rare endpoint 21ene.ip-ddns[.]com and performing unusual external data activity.

This dynamic DNS endpoint allows a device to access an endpoint using a domain name in place of a changing IP address. Dynamic DNS services ensure the DNS record of a domain name is automatically updated when the IP address changes. As such, malicious actors can use these services and endpoints to dynamically establish connections to C2 infrastructure [6].

Further investigation into this dynamic endpoint using OSINT revealed multiple associations with previous likely Blind Eagle compromises, as well as Remcos malware, a RAT commonly deployed via phishing campaigns [7][8][10].

Figure 3: Darktrace’s detection of the affected device connecting to the suspicious dynamic DNS endpoint, 21ene.ip-ddns[.]com.

Shortly after this, Darktrace observed the user agent ‘Microsoft-WebDAV-MiniRedir/10.0.19045’, indicating usage of the aforementioned transmission protocol WebDAV. The device was subsequently observed connected to an endpoint associated with Github and downloading data, suggesting that the device was retrieving a malicious tool or payload. The device then began to communicate to the malicious endpoint diciembrenotasenclub[.]longmusic[.]com over the new TCP port 1512 [11].

Around this time, the device was also observed uploading data to the endpoints 21ene.ip-ddns[.]com and diciembrenotasenclub[.]longmusic[.]com, with transfers of 60 MiB and 5.6 MiB observed respectively.

Figure 4: UI graph showing external data transfer activity.

This chain of activity triggered an Enhanced Monitoring model alert in Darktrace / NETWORK. These high-priority model alerts are designed to trigger in response to higher fidelity indicators of compromise (IoCs), suggesting that a device is performing activity consistent with a compromise.

Figure 5: Darktrace’s detection of initial attack chain activity.

A second Enhanced Monitoring model was also triggered by this device following the download of the aforementioned executable file (hxxp://62[.]60[.]226[.]112/file/3601_2042.exe) and the observed increase in C2 activity.

Following this activity, Darktrace continued to observe the device beaconing to the 21ene.ip-ddns[.]com endpoint.

Darktrace’s Cyber AI Analyst was able to correlate each of the individual detections involved in this compromise, identifying them as part of a broader incident that encompassed C2 connectivity, suspicious downloads, and external data transfers.

Figure 6: Cyber AI Analyst’s investigation into the activity observed on the affected device.

Figure 7: Cyber AI Analyst’s detection of the affected device’s broader connectivity throughout the course of the attack.

As the affected customer did not have Darktrace’s Autonomous Response configured at the time, the attack was able to progress unabated. Had Darktrace been properly enabled, it would have been able to take a number of actions to halt the escalation of the attack.

For example, the unusual beaconing connections and the download of an unexpected file from an uncommon location would have been shut down by blocking the device from making external connections to the relevant destinations.

Conclusion

The persistence of Blind Eagle and ability to adapt its tactics, even after patches were released, and the speed at which the group were able to continue using pre-established TTPs highlights that timely vulnerability management and patch application, while essential, is not a standalone defense.

Organizations must adopt security solutions that use anomaly-based detection to identify emerging and adapting threats by recognizing deviations in user or device behavior that may indicate malicious activity. Complementing this with an autonomous decision maker that can identify, connect, and contain compromise-like activity is crucial for safeguarding organizational networks against constantly evolving and sophisticated threat actors.

Credit to Charlotte Thompson (Senior Cyber Analyst), Eugene Chua (Principal Cyber Analyst) and Ryan Traill (Analyst Content Lead)

Appendices

IoCs

IoC – Type - Confidence
Microsoft-WebDAV-MiniRedir/10.0.19045 – User Agent

62[.]60[.]226[.]112 – IP – Medium Confidence

hxxp://62[.]60[.]226[.]112/file/3601_2042.exe – Payload Download – Medium Confidence

21ene.ip-ddns[.]com – Dynamic DNS Endpoint – Medium Confidence

diciembrenotasenclub[.]longmusic[.]com - Hostname – Medium Confidence

Darktrace’s model alert coverage

Anomalous File / Suspicious HTTP Redirect
Anomalous File / EXE from Rare External Location
Anomalous File / Multiple EXE from Rare External Location
Anomalous Server Activity / Outgoing from Server
Unusual Activity / Unusual External Data to New Endpoint
Device / Anomalous Github Download
Anomalous Connection / Multiple Connections to New External TCP Port
Device / Initial Attack Chain Activity
Anomalous Server Activity / Rare External from Server
Compromise / Suspicious File and C2
Compromise / Fast Beaconing to DGA
Compromise / Large Number of Suspicious Failed Connections
Device / Large Number of Model Alert

Mitre Attack Mapping:

Tactic – Technique – Technique Name

Initial Access - T1189 – Drive-by Compromise
Initial Access - T1190 – Exploit Public-Facing Application
Initial Access ICS - T0862 – Supply Chain Compromise
Initial Access ICS - T0865 – Spearphishing Attachment
Initial Access ICS - T0817 - Drive-by Compromise
Resource Development - T1588.001 – Malware
Lateral Movement ICS - T0843 – Program Download
Command and Control - T1105 - Ingress Tool Transfer
Command and Control - T1095 – Non-Application Layer Protocol
Command and Control - T1571 – Non-Standard Port
Command and Control - T1568.002 – Domain Generation Algorithms
Command and Control ICS - T0869 – Standard Application Layer Protocol
Evasion ICS - T0849 – Masquerading
Exfiltration - T1041 – Exfiltration Over C2 Channel
Exfiltration - T1567.002 – Exfiltration to Cloud Storage

References

1) https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/

2) https://assets.kpmg.com/content/dam/kpmgsites/in/pdf/2025/04/kpmg-ctip-blind-eagle-01-apr-2025.pdf.coredownload.inline.pdf

3) https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-remote-access-trojan/#:~:text=They%20might%20be%20attached%20to,remote%20access%20or%20system%20administration

4) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451

5) https://www.ionos.co.uk/digitalguide/server/know-how/webdav/

6) https://vercara.digicert.com/resources/dynamic-dns-resolution-as-an-obfuscation-technique

7) https://threatfox.abuse.ch/ioc/1437795

8) https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/remcos-malware/

9) https://www.virustotal.com/gui/url/b3189db6ddc578005cb6986f86e9680e7f71fe69f87f9498fa77ed7b1285e268

10) https://www.virustotal.com/gui/domain/21ene.ip-ddns.com

11) https://www.virustotal.com/gui/domain/diciembrenotasenclub.longmusic.com/community

About the author

Charlotte Thompson

Cyber Analyst

Blog

Email

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

‍

In today’s threat landscape, email remains the most targeted vector for cyberattacks. Organizations require not only multi-layered defenses but also advanced, integrated systems that work collaboratively to proactively mitigate threats before they cause damage

That’s why we’re proud to announce a new integration between Darktrace / EMAIL and Microsoft Defender for Office 365, delivering a Unified Quarantine experience that empowers security teams with seamless visibility, control, and response across both platforms.

This announcement builds on a strong and growing collaboration. In 2024, Darktrace was honored as Microsoft UK Partner of the Year and recognized as a Security Trailblazer at the annual Microsoft Security 20/20 Awards, a testament to our shared commitment to innovation and customer-centric security.

A Shared Mission: Stopping Threats at Machine Speed

This integration is more than a technical milestone,as it’s a reflection of a shared mission: to protect organizations from both known and unknown threats, with efficiency, accuracy, and transparency.

Microsoft Defender for Office 365 delivers a comprehensive security framework that safeguards Microsoft 365 email and collaboration workloads leveraging advanced AI, global threat intelligence and information on known attack infrastructure.
Darktrace / EMAIL complements this with Self-Learning AI that understands the unique communication patterns within each organization, detecting subtle anomalies that evade traditional detection methods.

Together, we’re delivering multi-layered, adaptive protection that’s greater than the sum of its parts.

“Our integration with Microsoft gives security teams the tools they need to act faster and more precisely to detect and respond to threats,” said Jill Popelka, CEO of Darktrace. “Together, we’re strengthening defenses where it matters most to our customers: at the inbox.”

Unified Quarantine: One View, Total Clarity

The new Unified Quarantine experience gives customers a single pane of glass to view and manage email threatsregardless of which product took action. This means:

Faster investigations with consolidated visibility
Clear attribution of actions and outcomes across both platforms
Streamlined workflows for security teams managing complex environments

“This integration is a testament to the power of combining Microsoft’s global threat intelligence with Darktrace’s unique ability to understand the ‘self’ of an organization,” said Jack Stockdale, CTO of Darktrace. “Together, we’re delivering a new standard in proactive, adaptive email security.”

A New Era of Collaborative Cyber Defense

This collaboration represents a broader shift in cybersecurity: from siloed tools to integrated ecosystems. As attackers become more sophisticated, defenders must move faster, smarter, and in unison.

Through this integration, Darktrace and Microsoft establish a new standard for collaboration between native and third-party security solutions, enhancing not only threat detection but also comprehensive understanding and proactive measures against threats.

We’re excited to bring this innovation to our customers and continue building a future where AI and human expertise collaborate to secure the enterprise.

[related-resource]

‍

About the author

Carlos Gray

Senior Product Marketing Manager, Email

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

How PlugX Malware Has Evolved & Adapted

What is PlugX Remote Access Trojan?

Understanding remote access trojans (RATs)

How does PlugX work?

Key capabilities of PlugX

Darktrace Coverage of PlugX

C2 Communication

New User Agent

Numeric File Download

Conclusion

Appendices

MITRE ATT&CK Framework

Indicators of Compromise (IoCs)

References

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

Enjoying the blog?

More in this series

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

Customer Case Study: Leading Petrochemical Manufacturer

Tracking CVE-2025-31324: Darktrace’s detection of SAP Netweaver exploitation before and after disclosure

Blog

Network

June 27, 2025

Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)

What is Blind Eagle?

What we know about Blind Eagle from a recent campaign

Darktrace’s coverage of Blind Eagle

Conclusion

Appendices

IoCs

Darktrace’s model alert coverage

References

Blog

Email

June 18, 2025

Darktrace Collaborates with Microsoft: Unifying Email Security with a Shared Vision

A Shared Mission: Stopping Threats at Machine Speed

Unified Quarantine: One View, Total Clarity

A New Era of Collaborative Cyber Defense