Malware
Korplug
- First Reported
- Jun 5, 2024
- Latest Reported
- Mar 19, 2026
Reported Context (2)
- an APT group named Carderbee using Cobra DocGuard to perform a supply chain attack to deliver the Korplug backdoor (aka PlugX) to multiple organizations in Hong Kong and a number of Asian countries. Researchers Detail Speagle Infostealer’s Abuse of Cobra DocGuard
- script, and discuss additional IP addresses identified as command and control infrastructure for Korplug samples on the server. Due to the sensitive nature of some of the server's files, we will obscure details Researchers Find PlugX Builder, Controller and Possible Victim Data on Exposed Server
Malware (2)
People (1)
Threat Actors (2)
MITRE ATT&CK (9)
Vendors (3)
Products (2)
Tools (5)
Industries (1)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.