PlugX executes DLL hijacking with benign applications such as ESET antivirus, Adobe Update etc. Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB