RedDelta Targets European Government Organizations and Continues to Iterate Custom PlugX Variant

Recorded Future's Insikt Group attributes a series of targeted espionage campaigns (Aug–Nov 2022) to the likely Chinese state-sponsored group RedDelta, which deployed a heavily modified PlugX RAT via malicious LNK/ISO delivery and DLL search-order hijacking. The report documents evolving payload encoding, decoy documents themed on European trade and migration, extracted PlugX configs and many IOCs (IP addresses, domains, and file hashes), maps techniques to MITRE ATT&CK, and provides mitigations for network and host defenders.