{"id":50795,"date":"2023-03-01T07:30:06","date_gmt":"2023-03-01T07:30:06","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/plugx-rat-masquerades-as-legit-windows-debugger-to-slip-past-security\/"},"modified":"2023-03-01T07:30:06","modified_gmt":"2023-03-01T07:30:06","slug":"plugx-rat-masquerades-as-legit-windows-debugger-to-slip-past-security","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/plugx-rat-masquerades-as-legit-windows-debugger-to-slip-past-security\/","title":{"rendered":"PlugX RAT masquerades as legit Windows debugger to slip past security"},"content":{"rendered":"

Cybercriminals are disguising the PlugX remote access trojan as a legitimate open-source Windows debugging tool to evade detection and compromise systems.<\/p>\n

In a recent case detailed<\/a> by Trend Micro, miscreants used a PlugX variant to hijack the popular x64dbg debugging tool to go undetected. The malware exploits a technique called DLL side-loading that’s been in use for over a decade. In this case PlugX loads a malicious payload after hijacking x64dbg, a trusted and digitally signed software application.<\/p>\n

“The discovery and analysis of the malware attack using the open-source debugger tool x32dbg.exe [the 32-bit debugger for x64dbg] shows us that DLL side loading is still used by threat actors today because it is an effective way to circumvent security measures and gain control of a target system,” the researchers wrote in a report this month.<\/p>\n