China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks

According to Cisco Talos researchers Joey Chen and Takahiro Takeda, a China-linked campaign is distributing a new variant of PlugX (aka Korplug or SOGU) targeting telecommunications and manufacturing sectors across Central and South Asia, with evidence it shares features with RainyDay and Turian backdoors, including the same DLL side-loading abuse, the XOR-RC4-RtlDecompressBuffer encryption/decryption method, and RC4 keys.

The new PlugX variant uses a different configuration structure from typical PlugX deployments and is linked, via its techniques and targets, to Lotus Panda (aka Naikon APT), also tracked as FoundCore by some vendors, with opinions that the two clusters may be the same entity or sourcing tools from a common vendor.

In one incident reported by the researchers, Naikon is said to have targeted a telecom firm in Kazakhstan, and both Lotus Panda and BackdoorDiplomacy have been observed focusing on South Asian countries, suggesting a broader regional interest.

Separately, Palo Alto Networks Unit 42 shed light on the Mustang Panda Bookworm malware, active since 2015, used to gain extensive control over compromised systems and to execute commands, upload/download files, exfiltrate data and maintain persistence, with Bookworm also sharing DLL side-loading characteristics and modular architecture that allows loading modules directly from its C2 server.

The article notes that recent Bookworm variants have packaged shellcode as UUID strings and that Bookworm operates alongside other Stately Taurus operations, underscoring a long-term commitment to its development by the group.