Chinese APT Launches Spearphishing Campaign, Using Fake Cloudflare Lure to Deliver PlugX Malware

StrikeReady Labs details a sophisticated spear-phishing campaign targeting European government and aviation entities that delivers PlugX (Sogu/Korplug) malware via specially crafted ZIP archives and malicious LNKs; the attack chain uses PowerShell carving, DLL sideloading of a legitimate Canon binary, Azure-hosted C2 domains, and decoy documents, with forensic links to PRC-aligned espionage clusters and reusable artifacts observed across prior campaigns.