HenBox__2019__PKPLUG_Chinese_Cyber_Espionage_Group_Attacking_Asia.pdf

Unit 42 profiles “PKPLUG,” a multi-year, Chinese-attributed cyber-espionage cluster targeting countries and regions across Asia (notably Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet and Xinjiang) that deploys both public and bespoke malware — including PlugX, Poison Ivy, 9002, HenBox (Android) and Farseer (Windows) — via spear-phishing, DLL side‑loading and PowerShell techniques; the report maps infrastructure overlaps, documents TTPs and IoCs, and provides a STIX 2.0 Adversary Playbook for detection and sharing.