RA World ransomware used PlugX malware in Nov 2024, hinting at a lone hacker monetizing Chinese espionage tools.