A sophisticated espionage operation attributed to PRC-nexus threat actor UNC6384 has been caught abusing a little-noticed part of how browsers check internet connectivity to infect targets – then stealthily deploy a memory-resident backdoor. Google Threat Intelligence says diplomats in Southeast Asia were the primary focus, with additional victims globally, and assesses the activity as aligned with the strategic interests of the People’s Republic of China.
At the heart of the operation is a clever twist on “captive portal” behaviour—the mechanism that redirects users to a login or splash page when joining hotels, airports or enterprise guest Wi-Fi. Chrome, for example, pings a known URL (http://www.gstatic.com/generate_204) to test if it’s behind such a portal. In this campaign, an adversary-in-the-middle (AitM) intercepts that check and silently diverts the victim to an attacker-controlled site, where a fake “plugin update” is offered. That lures the target into downloading a signed first-stage downloader GTIG tracks as STATICPLUGIN, kicking off a multi-stage chain that ends with an in-memory SOGU.SEC (aka PlugX) backdoor. Google Cloud
The social engineering is polished. The landing page is served over HTTPS with a valid Let’s Encrypt certificate for mediareleaseupdates[.]com, suppressing browser “Not Secure” warnings and making network inspection harder. The downloaded binary –AdobePlugins.exe – is digitally signed using a certificate issued to Chengdu Nuoxin Times Technology Co., Ltd., conferring a veneer of legitimacy that can bypass trust-based endpoint controls. GTIG notes the binary was signed in May 2025 and that at least 25 other suspicious samples share subscriber details, used across multiple PRC-linked clusters.
Persistence and execution are equally deceptive. After the initial drop, the malware retrieves an MSI that installs a legitimate Canon IJ Printer Assistant Tool executable alongside a malicious launcher GTIG dubs CANONSTAGER. The launcher abuses DLL sideloading to execute SOGU.SEC entirely in memory, using API hashing and Thread Local Storage tricks to hide function calls and frustrate analysis.
Google reports it has notified impacted Gmail and Workspace users with government-backed attacker alerts, added the identified infrastructure and hashes to Safe Browsing, and pushed relevant intel into Google Security Operations to help defenders hunt similar activity. Recommended user actions include enabling Enhanced Safe Browsing in Chrome, keeping devices fully updated, and enforcing 2-Step Verification.
Why this matters: captive-portal deception blends network manipulation, trust abuse (valid TLS and code signing) and living-off-the-land execution to slip past layered controls. Even organisations outside the diplomatic sphere could be collateral in shared infrastructure or travel contexts.
Defensive takeaways for security teams:
-
Treat connectivity-check redirects as inspectable signals; unusual
generate_204flows should trigger scrutiny. -
Harden and monitor edge devices; GTIG assesses compromised edge gear likely enabled the AitM.
-
Don’t equate “validly signed” with “benign”; verify signer reputation and use certificate intelligence in EDR rules.
-
Watch for DLL sideloading via legit binaries (e.g., printer tools) and memory-only backdoors in EDR telemetry.
-
Block and hunt on the published IOCs and artefacts referenced by GTIG.
As attackers lean into deception and supply-chain trust signals, defenders must assume the portal is the point of entry.
