Chinese APT Launches Spearphishing Campaign, Using Fake Cloudflare Lure to Deliver PlugX Malware

A new StrikeReady Labs report describes a sophisticated spearphishing campaign that targets European governmental and aviation sectors, with links to Chinese state-sponsored threat actors using PlugX (also known as Sogu or Korplug) malware.

According to StrikeReady’s analysts, the attack began with an email linking to a fake Cloudflare “Turnstile” page designed to resemble a CAPTCHA challenge, followed by a decoy PowerShell sequence that extracts a second payload from a ZIP archive named “NAJU Plan Obuka OKTOBAR 2025[.]zip.” The ZIP contains a legitimate Canon Printer Assistant binary, a malicious sideloaded DLL,

and a configuration file, with the malware later contacting a C2 domain associated with prior Chinese espionage campaigns via naturadeco[.]net. The campaign employs Azure-based domains (web.core.windows[.]net) to blend in with legitimate traffic, and newer variants use a file carving algorithm that seeks four consecutive 0x55 bytes to carve MSI installers, connecting to paquimetro[.]net.

While StrikeReady did not name a specific APT group, the forensic evidence points to a Chinese cyber-espionage nexus, with researchers noting that PlugX artifacts have appeared across campaigns dating back to 2023.