Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 23:21:04 UTC
Home > List all groups > List all tools > List all groups using tool xsPlus
 Tool: xsPlus
Names
xsPlus
xsControl
nokian
Category Malware
Type Loader, Backdoor
Description
(Kaspersky) In 2014 the Naikon gang was found to be using another tool that maintains an
internal name “xsPlus” and “xsControl”. This builder and its backdoors produce components
with the “NOKIAN95/WEBx” user-agent strings, for which there are multiple versions.
Information
Malpedia Last change to this tool card: 14 May 2020
Download this tool card in JSON format
All groups using tool xsPlus
Changed Name Country Observed
APT groups
 Naikon, Lotus Panda 2010-Apr 2022
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0d785f4-56fb-46ad-a134-0b50133bdc03
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0d785f4-56fb-46ad-a134-0b50133bdc03
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0d785f4-56fb-46ad-a134-0b50133bdc03
Page 2 of 2

APT groups Naikon, Lotus Panda 2010-Apr 2022 
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2