Cisco Uncovers New PlugX Backdoor Linked to Chinese APTs

According to Cisco Talos, researchers uncovered a long-running espionage campaign active since 2022 that targets the telecommunications and manufacturing sectors across Central and South Asia, centred on a new variant of the PlugX backdoor. The variant shows extensive overlaps with the RainyDay and Turian backdoors and borrows from the same legitimate applications for DLL sideloading, as well as the XOR-RC4-RtlDecompressBuffer algorithm used to encrypt and decrypt payloads and the RC4 keys.

Talos notes that the campaign’s configuration mirrors RainyDay’s structure, leading to medium confidence that this variant of PlugX can be attributed to Naikon, a Chinese-speaking espionage group active since at least 2010. The findings also blur the line between Naikon and BackdoorDiplomacy, another APT known for deploying the Turian backdoor, with researchers suggesting they may be the same group or sourcing tools from the same vendor.

Both groups continue to target telecom operators in South and Central Asia, occasionally hitting adjacent countries as part of a long-standing regional espionage pattern.