Chinese Cyber-Spies Use Espionage Tools for Ransomware Side Hustle

Symantec linked a $2M RA World ransomware extortion against an Asian company to the same PlugX backdoor and toolset used in China-linked espionage campaigns (including Mustang Panda/Fireant). Attackers exploited CVE-2024-0012 in PAN-OS to steal admin and AWS S3 credentials, sideloaded a malicious DLL to deploy a custom PlugX variant, and may represent a case of espionage-tool “moonlighting” for financial gain; similar PlugX activity was later observed against multiple government and telecom targets.