Hogfarming.7z

: Launching the primary file triggers the sideloading of a malicious component (often disguised as a library like MpsSvc.dll or similar).

: It is frequently utilized in campaigns that leverage DLL Side-Loading techniques. In these scenarios, a legitimate, digitally signed executable is bundled with a malicious DLL that the executable is forced to load. HogFarming.7z

: Once the user extracts "HogFarming.7z", they find what appears to be a legitimate document or application. : Launching the primary file triggers the sideloading

Security teams should monitor for the following indicators related to this specific file name and associated threat actor behavior: : HogFarming.7z : Once the user extracts "HogFarming

: Analysis suggests the archive often carries variants of the PlugX or ToneIns malware. PlugX is a modular Remote Access Trojan (RAT) used for data exfiltration, keystroke logging, and remote command execution.