What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Nov 21, 2022
ProxyNotShell Exploit Released
THE THREAT eSentire is aware of public Proof-of-Concept (PoC) exploit code for the ProxyNotShell Exchange vulnerabilities (CVE-2022-41040 [CVSS:8.8], CVE-2022-41082 [CVSS:8.0]). The publication of…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Nov 07, 2022
Global Cybersecurity Leader eSentire Partners with InfoTrust to Deliver 24/7 Multi-Signal MDR and IR Services Across Australia
Waterloo, ON and Sydney, Australia – November 9, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has expanded its presence in Australia via a strategic partnership with InfoTrust. InfoTrust is a leading specialized cybersecurity provider that combines next-generation security controls, with the InfoTrust “Connective Tissue” of customer success,…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Incident report

Proof of Concept Reveals PlugX Trojan Intrusion of 6+ Years

Attack Types:

PlugX Trojan

Industry:

Non-profit research organization

A cyberattack can compromise systems that drive an organization’s operations and expose sensitive data. Financial institutions are obvious targets, but opportunistic cybercriminals will target organizations they suspect do not have banking-level security. In this case, a non-profit research organization was unaware a PlugX trojan had invaded its network and had been present for more than six years. Fortunately, eSentire’s Security Operation Center (SOC), leveraging MDR for Network and MDR for Endpoint, quickly detected the threat actor’s presence during a proof of concept exercise.

Patient Zero

eSentire was conducting a proof of concept (POC) with a potential customer. We installed an eSentire MDR for Network sensor, which immediately triggered an alert in our Security Operations Center (SOC) for a Command and Control check in for a PlugX trojan. Based on this, eSentire received permission from the customer to install an endpoint sensor on the machine that triggered the alert of a PlugX trojan, a remote access tool (RAT) that uses modular plugins. It is a common tool used by multiple threat groups because it is complex and often evades typical security measures.

Investigation revealed that legitimate antivirus (AV) software had been used to install the malicious trojan without being detected by the AV, through a technique called dll hijacking. The trojan had a lot of complexity and encryption, so that it did not appear malicious. It included a “do not execute until 2013” time code, revealing that the machine had been infected for several years. Decrypting this was no easy task.

The trojan initially loads a dll that is a simple launcher. It looks for an encrypted, hidden “stage-one” payload, which then launches a “stage-two” payload, also hidden, encrypted and compressed. When unpacked, it launches the final, malicious dll file containing the trojan. Investigation showed two functionalities for the final payload: periodic screenshots of the infected machine and a keystroke logger. There was no evidence of any screenshots to be found. But, we decrypted a 30mb file of keystroke data with timestamps going back to 2014.

Threat Quickly Eliminated

eSentire isolated the affected machine when we installed the endpoint sensor. It is unknown when the initial infection occurred because there was no sensor on the endpoint to collect telemetry. The malware had a network channel back to the attacker, but we had no way to prove what they saw. Luckily, what we were able to find in the 30mb file was not the company’s critical data. The customer had an IT security company monitoring their network and they detected nothing for five-plus years. During the eSentire POC, eSentire detected, isolated, investigated and removed the longstanding threat in less than two weeks.

Summary of Events

Download Now