MITRE ATT&CKcampaign
C0047 RedDelta Modified PlugX Infection Chain Operations
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-01-14
Description
RedDelta Modified PlugX Infection Chain Operations was executed by Mustang Panda from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. RedDelta Modified PlugX Infection Chain Operations involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load PlugX on victim machines in a persistent state.
Related
Attributed to · MITRE ATT&CK (1)
- G0129 Mustang Panda group
Uses · MITRE ATT&CK (24)
- T1027.013 Encrypted/Encoded File sub-technique
- T1218.014 MMC sub-technique
- S0596 ShadowPad software (malware)
- T1608.001 Upload Malware sub-technique
- T1588.004 Digital Certificates sub-technique
- T1583.001 Domains sub-technique
- T1071.001 Web Protocols sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1553.002 Code Signing sub-technique
- T1218.007 Msiexec sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1480 Execution Guardrails technique
- T1203 Exploitation for Client Execution technique
- S0013 PlugX software (malware)
- T1082 System Information Discovery technique
- T1090 Proxy technique
- T1095 Non-Application Layer Protocol technique
References
- https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf Recorded Future RedDelta 2025