UNC6384: Captive-Portal PlugX Implant

A diplomat's managed laptop on a conference network started making outbound connections that do not match the user's normal traffic, minutes after a captive-portal sign-in. Before pivoting through the evidence, get oriented on what you are looking at and which surfaces hold the answers.

The intrusion began when the laptop's connectivity check was tampered with on the untrusted network. Trace the proxy and DNS records from the connectivity probe to the attacker page and identify the host the browser was steered to.

The attacker page delivered a bundle built around a trusted, signed application. The dangerous component is not the signed executable but the file loaded beside it. Use the endpoint and Sysmon evidence to name it.

Put a name to how the attacker got code to run inside a trusted, signed process. Map the technique you just reconstructed to MITRE ATT&CK.

Once loaded, the implant ran in memory and reached out to its operator. Separate that callback from ordinary encrypted browsing and identify the single external host it used.

The actor wanted the foothold to survive a reboot. Using the Sysmon and endpoint records, identify the registry value the loader wrote so it would relaunch automatically.

Wrap up by mapping the exfiltration to MITRE ATT&CK. The implant did not build a separate upload site: the data left over the channel it was already using.