PlugX USB Worm Hits Multiple Continents via DLL Sideloading

A new PlugX USB worm variant is actively propagating across multiple countries by abusing DLL sideloading of a legitimate Avast executable (AvastSvc.exe) paired with a malicious wsc.dll and encrypted PlugX payload; it hides components in RECYCLER.BIN, uses renamed loaders and shortcut tricks to execute from removable media, collects discovery outputs and documents for exfiltration, and calls back to C2 infrastructure (notably 45.142.166.112) linked to PKPLUG/Mustang Panda.