APT1 has deployed the PlugX RAT to execute commands and manipulate system processes, ensuring continued access and control over the network. The RAT was executed from a suspicious executable found on the endpoint.