misp-galaxy:microsoft-activity-group="GALLIUM",misp-galaxy:mitre-enterprise-attack-intrusion-set="DragonOK - G0017",misp-galaxy:mitre-intrusion-set="DragonOK - G0017",misp-galaxy:mitre-intrusion-set="Mustang Panda - G0129",misp-galaxy:threat-actor="DragonOK",misp-galaxy:threat-actor="Earth Berberoka",misp-galaxy:threat-actor="GALLIUM",misp-galaxy:threat-actor="Mustang Panda",misp-galaxy:mitre-enterprise-attack-malware="Winnti - S0141",misp-galaxy:threat-actor="Axiom",misp-galaxy:mitre-enterprise-attack-intrusion-set="Winnti Group - G0044",misp-galaxy:mitre-intrusion-set="Winnti Group - G0044",type:OSINT,osint:lifetime="perpetual",osint:certainty="50",tlp:white,osint:source-type="technical-report",misp-galaxy:malpedia="PlugX",misp-galaxy:mitre-enterprise-attack-malware="PlugX - S0013",misp-galaxy:mitre-malware="PlugX - S0013",misp-galaxy:rat="PlugX",misp-galaxy:tool="PlugX",misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1192",misp-galaxy:mitre-attack-pattern="Spearphishing Link - T1566.002",misp-galaxy:mitre-attack-pattern="JavaScript - T1059.007",misp-galaxy:mitre-attack-pattern="Visual Basic - T1059.005",misp-galaxy:mitre-attack-pattern="Component Object Model - T1559.001",misp-galaxy:mitre-attack-pattern="Service Execution - T1569.002",misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060",misp-galaxy:mitre-attack-pattern="Windows Service - T1543.003",misp-galaxy:mitre-attack-pattern="Bypass User Account Control - T1088",misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-attack-pattern="Hidden Files and Directories - T1564.001",misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002",misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1073",misp-galaxy:mitre-attack-pattern="Disable or Modify Tools - T1562.001",misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004",misp-galaxy:mitre-attack-pattern="Masquerade Task or Service - T1036.004",misp-galaxy:mitre-attack-pattern="Match Legitimate Name or Location - T1036.005",misp-galaxy:mitre-attack-pattern="Modify Registry - T1112",misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027",misp-galaxy:mitre-attack-pattern="Software Packing - T1027.002",misp-galaxy:mitre-attack-pattern="Software Packing - T1045",misp-galaxy:mitre-attack-pattern="Process Hollowing - T1055.012",misp-galaxy:mitre-attack-pattern="Phishing - T1566",misp-galaxy:mitre-attack-pattern="Command and Scripting Interpreter - T1059",misp-galaxy:mitre-attack-pattern="Inter-Process Communication - T1559",misp-galaxy:mitre-attack-pattern="System Services - T1569",misp-galaxy:mitre-attack-pattern="User Execution - T1204",misp-galaxy:mitre-attack-pattern="Boot or Logon Autostart Execution - T1547",misp-galaxy:mitre-attack-pattern="Create or Modify System Process - T1543",misp-galaxy:mitre-attack-pattern="Abuse Elevation Control Mechanism - T1548",misp-galaxy:mitre-attack-pattern="Hijack Execution Flow - T1574",misp-galaxy:mitre-attack-pattern="Hide Artifacts - T1564",misp-galaxy:mitre-attack-pattern="Impair Defenses - T1562",misp-galaxy:mitre-attack-pattern="Indicator Removal on Host - T1070",misp-galaxy:mitre-attack-pattern="Masquerading - T1036",misp-galaxy:mitre-attack-pattern="Process Injection - T1055",misp-galaxy:mitre-attack-pattern="Network Service Discovery - T1046",misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135",misp-galaxy:mitre-attack-pattern="Process Discovery - T1057",misp-galaxy:mitre-attack-pattern="Query Registry - T1012",misp-galaxy:mitre-attack-pattern="Remote System Discovery - T1018",misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082",misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049",misp-galaxy:mitre-attack-pattern="System Service Discovery - T1007",misp-galaxy:mitre-attack-pattern="System Network Configuration Discovery - T1016",misp-galaxy:mitre-attack-pattern="Remote Services - T1021",misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1021.001",misp-galaxy:mitre-attack-pattern="Remote Desktop Protocol - T1076",misp-galaxy:mitre-attack-pattern="Automated Collection - T1119",misp-galaxy:mitre-attack-pattern="Clipboard Data - T1115",misp-galaxy:mitre-attack-pattern="Data from Local System - T1005",misp-galaxy:mitre-attack-pattern="Input Capture - T1056",misp-galaxy:mitre-attack-pattern="Keylogging - T1056.001",misp-galaxy:mitre-attack-pattern="Screen Capture - T1113",misp-galaxy:mitre-attack-pattern="Data Encoding - T1132",misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001",misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573",misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105",misp-galaxy:mitre-attack-pattern="Non-Application Layer Protocol - T1095",misp-galaxy:mitre-attack-pattern="Proxy - T1090",misp-galaxy:mitre-attack-pattern="External Proxy - T1090.002",misp-galaxy:mitre-attack-pattern="Protocol Impersonation - T1001.003",misp-galaxy:mitre-attack-pattern="Standard Encoding - T1132.001",misp-galaxy:mitre-attack-pattern="Symmetric Cryptography - T1573.001",misp-galaxy:mitre-attack-pattern="Exfiltration Over C2 Channel - T1041"