The Federal Bureau of Investigation (FBI), in cooperation with French law enforcement and security partners, has successfully removed malware from thousands of computers worldwide, including home computers in the United States. The malware, known as "PlugX," was linked to Chinese government-backed hackers, specifically a hacking group called Mustang Panda, which used the malware to control and steal information from unsuspecting victims.

The U.S. Attorney's Office for the Eastern District of Pennsylvania announced on Tuesday that the Chinese government had paid Mustang Panda to develop a specific version of the PlugX malware. The group used this malware to target various entities, including European shipping companies, European governments, Chinese dissident groups, and governments in the Indo-Pacific region.

U.S. Attorney Jacqueline C. Romero, in a statement, described the hack as a "wide-ranging" and "long-term infection" that impacted thousands of Windows computers, including home computers in the U.S. Romero emphasized that the attack showcased the "recklessness and aggressiveness" of state-sponsored hackers from the People's Republic of China. FBI Philadelphia Special Agent in Charge Wayne Jacobs confirmed that the FBI had identified thousands of infected U.S. computers and had worked to delete the Chinese malware from these devices.

The operation was led by French law enforcement with assistance from France-based cybersecurity company, Sekoia.io. The company had identified the capability to send commands to delete the malware from infected devices and played a critical role in the disinfection operation, which began in July 2023 and continued for several months. Sekoia had previously reported that the first known version of PlugX was seen during a Chinese campaign targeting government-related users and organizations in Japan. The malware initially targeted victims in Asia but gradually expanded its scope, and by 2012, it began targeting a broader range of global victims.

According to the FBI, the collaboration with French partners allowed for testing and confirming the effectiveness of sending commands to delete PlugX from infected devices. The malware variant spreads through computer USB ports, infecting attached USB devices, and potentially spreading to other Windows-based computers once the USB device is plugged in. After infection, the malware stays on the computer and communicates with a command-and-control server, which has a difficult-to-change IP address. The server can then send commands to the malware on the victim's device.

The affidavit filed with the case stated that Mustang Panda, also known as "Twill Typhoon," had been using PlugX malware since at least 2014. The group infiltrated computer systems belonging to both government and private organizations, including in the United States. As of September 2023, at least 45,000 IP addresses in the U.S. had interacted with a specific command-and-control server linked to Mustang Panda.

The malware variant in question includes a "self-delete" command, which instructs the malware to delete files it created on the infected computer and cease its operation. The FBI confirmed that the self-delete command did not affect legitimate files or operations on the victim's device. Working with French authorities, the FBI was able to send the self-delete command to over 4,200 infected U.S. computers, removing the malware from these networks.

The U.S. Department of Justice and FBI obtained the first of nine court-approved warrants in the Eastern District of Pennsylvania in August 2023. The final warrant expired on January 3, 2024. In total, this court-authorized operation removed PlugX malware from approximately 4,258 U.S.-based computers and networks.

This operation highlights the ongoing efforts of the U.S. and international partners to combat state-sponsored cyber threats and protect global computer networks from malicious attacks.