In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia | Proofpoint

Proofpoint documents a prolonged, targeted attack campaign aimed at Russian telecom and military interests, leveraging PlugX RAT via spear-phishing Word attachments and RAR archives, with decoy content referencing the Tsar Bomba. The campaign uses DLL sideloading and various backdoors (Saker, Netbot, DarkStRat) with a shared C2 infrastructure and multiple in-the-wild IOCs.