Gold Open Source

Explore Packages Vulnerabilities CWEs MCP Servers Scan

Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

Explore Everything
Packages
Gold Certified Packages
Container Images
AI Models
MCP Servers
Agent Skills
Chip Manufacturers

Security Data & Tools

Scan Your Dependencies
Trending Threats
Threat RSS Feeds
CVE Database
Actively Exploited (KEV)
SGZ Zero-Days
CWE Index
MITRE ATT&CK
Malicious Packages
Security Glossary
Supply-Chain Report
Developers (API & Badge)
Chrome Extension
Credits & Data Sources

Products

The Platform
ESSCM
Portal
TPRM
OSM
Cowork
Code / Runner
Guard

Use Cases

Know Your Software
Auto-Fix Vulnerabilities
Asset Discovery
AI Governance
MCP Server Security
Supply Chain Compliance
Zero-Day Discovery
All Use Cases

Company

About
Pricing
Blog
Documentation
Safeguard Academy
Contact
Privacy Policy
Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard

Home/ATT&CK/Software/S0013

MITRE ATT&CK Malware

PlugX (S0013)

ThoperTVTDestroyRATSoguKabaKorplug

ShareX LinkedIn Reddit HN

[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)

Platforms: Windows

▪Techniques implemented (49)

T1622Debugger Evasion T1112Modify Registry T1083File and Directory Discovery T1614System Location Discovery T1036.004Masquerade Task or Service T1091Replication Through Removable Media T1480.002Mutual Exclusion T1016System Network Configuration Discovery T1564.001Hidden Files and Directories T1095Non-Application Layer Protocol T1204.002Malicious File T1680Local Storage Discovery T1056.001Keylogging T1102.001Dead Drop Resolver T1124System Time Discovery T1620Reflective Code Loading T1057Process Discovery T1012Query Registry T1574.001DLL T1070.009Clear Persistence T1135Network Share Discovery T1127.001MSBuild T1071.001Web Protocols T1543.003Windows Service T1059.003Windows Command Shell T1105Ingress Tool Transfer T1686Disable or Modify System Firewall T1082System Information Discovery T1074.001Local Data Staging T1497.001System Checks T1049System Network Connections Discovery T1036.005Match Legitimate Resource Name or Location T1547.001Registry Run Keys / Startup Folder T1027.001Binary Padding T1071.004DNS T1070.004File Deletion T1113Screen Capture T1053.005Scheduled Task T1573.001Symmetric Cryptography T1571Non-Standard Port T1027.007Dynamic API Resolution T1140Deobfuscate/Decode Files or Information T1564.003Hidden Window T1120Peripheral Device Discovery T1041Exfiltration Over C2 Channel T1106Native API T1027Obfuscated Files or Information T1033System Owner/User Discovery T1027.013Encrypted/Encoded File

▪Used by groups (15)

G1047Velvet Ant G1034Daggerfly G0096APT41 G0022APT3 G0126Higaisa G0027Threat Group-3390 G1021Cinnamon Tempest G0093GALLIUM G0001Axiom G0045menuPass G0062TA459 G1014LuminousMoth G0017DragonOK G0044Winnti Group G0129Mustang Panda

S0013on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.