Google Threat Intelligence Exposes UNC6384’s Stealthy Espionage Campaign

According to Google Threat Intelligence Group (GTIG), a complex, multi-stage cyber-espionage campaign attributed to the PRC-linked threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The operation began with hijacking captive portals to deliver malware disguised as an Adobe plugin update, with the campaign sending a digitally signed downloader tracked as STATICPLUGIN and culminating in the in-memory deployment of the SOGU[.]SEC backdoor (also known as PlugX).

Victims saw a fake update page over HTTPS with a valid TLS certificate, and when users clicked “Install Missing Plugins” they downloaded AdobePlugins.exe, signed to Chengdu Nuoxin Times Technology Co., Ltd. The malware delivery involved a STATICPLUGIN Downloader masquerading as a Microsoft Visual C++ Redistributables installer, an MSI Package Delivery containing a Canon utility executable, a malicious CANONSTAGER DLL, and a DLL side-loaded by the Canon executable to launch SOGU[.]SEC.

GTIG noted that CANONSTAGER uses a control flow obfuscation technique with custom API hashing and TLS, with execution triggered indirectly via the Windows message queue. Google attributes the campaign to UNC6384, with claimed ties to TEMP[.]Hex (Mustang Panda), and notes both groups have delivered SOGU[.]SEC via DLL side-loading and overlapped infrastructure targeting government sectors in Southeast Asia.