Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX | Proofpoint

**Executive summary:** Proofpoint researchers describe a China-associated APT campaign that introduced a new downloader called ZeroT to deliver PlugX via spear-phishing (CHM/Word/RAR SFX), UAC bypass/sideload techniques, and BMP LSB steganography for stage-2 payloads; the report includes protocol details, C2 domains, IOCs, and sample PlugX configurations.