{"id":3129,"date":"2026-02-26T10:30:02","date_gmt":"2026-02-26T09:30:02","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=3129"},"modified":"2026-03-02T09:55:56","modified_gmt":"2026-03-02T08:55:56","slug":"plugx-meeting-invitation-via-msbuild-and-gdata","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/plugx-meeting-invitation-via-msbuild-and-gdata\/","title":{"rendered":"PlugX Meeting Invitation via MSBuild and GDATA"},"content":{"rendered":"\n

In relation to the latest variant of the PlugX RAT executed by STATICPLUGIN analyzed by IIJ-SECT<\/a>, LAB52 aims to complement this information with additional observed deployment activity and encryption characteristics in samples analyzed by this team.<\/p>\n\n\n\n

\n\n\n\n

PlugX<\/h1>\n\n\n\n

PlugX is a long-running Remote Access Trojan (RAT) that has been consistently linked to multiple China-aligned threat actors and espionage operations worldwide. Since its public identification around 2008, it has been attributed to groups such as Mustang Panda, APT41, APT10, and Deep Panda, among others. These actors have deployed PlugX in targeted campaigns affecting government institutions, diplomatic entities, defense organizations, technology companies, energy providers, and NGOs across Europe, Asia, and North America. Its sustained use over more than a decade reflects both its adaptability and its operational value within China-linked cyber-espionage ecosystems.<\/p>\n\n\n\n

From an operational standpoint, PlugX is typically delivered through spear-phishing emails carrying malicious attachments, weaponized Word or Excel documents with macros, executables disguised as legitimate software, or via supply chain compromise scenarios. A recurring characteristic of PlugX campaigns is the abuse of DLL side-loading, in which legitimate and often digitally signed applications are leveraged to load malicious DLLs, thereby reducing suspicion and bypassing certain security controls. This combination of social engineering, trusted software abuse, and modular payload design has enabled PlugX to remain a relevant and frequently observed tool in international cyber-espionage operations.<\/p>\n\n\n\n

\n\n\n\n

Initial Deployment<\/h1>\n\n\n\n

In this case, during the deployment of PlugX, the G DATA antivirus executable (Avk.exe) is used to load the malicious DLL Avk.dll via DLL side-loading. In the case analysed by LAB52, the infection chain begins with a phishing email titled \u201cMeeting Invitation\u201d followed by a date. The content includes two links:<\/p>\n\n\n\n