appbox1

SophosLabs (Feb 2015) describes evolution of the PlugX backdoor family: new P2P communication and a technique storing encrypted payloads in the Windows registry. The report details two classes of exploited RTF carrier documents (CVE-2012-0158), a multi-stage XOR/encrypted shellcode installer that drops loaders and payloads, multiple targeted campaigns (notably in India and Russia), persistence mechanisms, and numerous indicators (filenames, C2 domains, and sample hashes) useful for detection and response.