A Chinese hacking group has been attributed to a new campaign aimed at infecting government officials in Europe, the Middle East, and South America with a modular malware known as PlugX.
Cybersecurity firm Secureworks said it identified the intrusions in June and July 2022, once again demonstrating the adversary's continued focus on espionage against governments around the world.
"PlugX is modular malware that contacts a command and control (C2) server for tasking and can download additional plugins to enhance its capability beyond basic information gathering," Secureworks Counter Threat Unit (CTU) said in a report shared with The Hacker News.
Bronze President is a China-based threat actor active since at least July 2018 and is likely estimated to be a state-sponsored group that leverages a mix of proprietary and publicly available tools to compromise and collect data from its targets.
It's also publicly documented under other names such as HoneyMyte, Mustang Panda, Red Lich, and Temp.Hex. One of its primary tools of choice is PlugX, a remote access trojan that has been widely shared among Chinese adversarial collectives.
https://thehackernews.com/2022/09/chinese-hackers-target-government.html?fbclid=IwAR1WivfTjD7_gVGUNG5X6PeVk ZI4VAk5vzOgl0pPa8zwzCol_cZ1Vqo0BZU