Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0013
MITRE ATT&CK Malware

PlugX (S0013)

ThoperTVTDestroyRATSoguKabaKorplug
ShareXLinkedInRedditHN

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)

Platforms: Windows

▪Techniques implemented (49)

T1622Debugger EvasionT1112Modify RegistryT1083File and Directory Discovery

▪Used by groups (15)

G0093GALLIUMG0022APT3G0096APT41
S0013 on MITRE ATT&CK →
T1614System Location Discovery
T1036.004Masquerade Task or Service
T1091Replication Through Removable Media
T1480.002Mutual Exclusion
T1016System Network Configuration Discovery
T1564.001Hidden Files and Directories
T1095Non-Application Layer Protocol
T1204.002Malicious File
T1680Local Storage Discovery
T1056.001Keylogging
T1102.001Dead Drop Resolver
T1124System Time Discovery
T1620Reflective Code Loading
T1057Process Discovery
T1012Query Registry
T1574.001DLL
T1070.009Clear Persistence
T1135Network Share Discovery
T1127.001MSBuild
T1071.001Web Protocols
T1543.003Windows Service
T1059.003Windows Command Shell
T1105Ingress Tool Transfer
T1686Disable or Modify System Firewall
T1082System Information Discovery
T1074.001Local Data Staging
T1497.001System Checks
T1049System Network Connections Discovery
T1036.005Match Legitimate Resource Name or Location
T1547.001Registry Run Keys / Startup Folder
T1027.001Binary Padding
T1071.004DNS
T1070.004File Deletion
T1113Screen Capture
T1053.005Scheduled Task
T1573.001Symmetric Cryptography
T1571Non-Standard Port
T1027.007Dynamic API Resolution
T1140Deobfuscate/Decode Files or Information
T1564.003Hidden Window
T1120Peripheral Device Discovery
T1041Exfiltration Over C2 Channel
T1106Native API
T1027Obfuscated Files or Information
T1033System Owner/User Discovery
T1027.013Encrypted/Encoded File
G0045menuPass
G0129Mustang Panda
G0126Higaisa
G0062TA459
G1021Cinnamon Tempest
G0001Axiom
G1014LuminousMoth
G0044Winnti Group
G1047Velvet Ant
G0017DragonOK
G1034Daggerfly
G0027Threat Group-3390

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.