FOLLOW US

The Federal Bureau of Investigation (FBI), in cooperation with French law enforcement and security partners, has successfully removed malware from thousands of computers worldwide, including home computers in the United States. The malware, known as "PlugX," was linked to Chinese government-backed hackers, specifically a hacking group called Mustang Panda, which used the malware to control and steal information from unsuspecting victims.

The U.S. Attorney's Office for the Eastern District of Pennsylvania announced on Tuesday that the Chinese government had paid Mustang Panda to develop a specific version of the PlugX malware. The group used this malware to target various entities, including European shipping companies, European governments, Chinese dissident groups, and governments in the Indo-Pacific region.

U.S. Attorney Jacqueline C. Romero, in a statement, described the hack as a "wide-ranging" and "long-term infection" that impacted thousands of Windows computers, including home computers in the U.S. Romero emphasized that the attack showcased the "recklessness and aggressiveness" of state-sponsored hackers from the People's Republic of China. FBI Philadelphia Special Agent in Charge Wayne Jacobs confirmed that the FBI had identified thousands of infected U.S. computers and had worked to delete the Chinese malware from these devices.

The operation was led by French law enforcement with assistance from France-based cybersecurity company, Sekoia.io. The company had identified the capability to send commands to delete the malware from infected devices and played a critical role in the disinfection operation, which began in July 2023 and continued for several months. Sekoia had previously reported that the first known version of PlugX was seen during a Chinese campaign targeting government-related users and organizations in Japan. The malware initially targeted victims in Asia but gradually expanded its scope, and by 2012, it began targeting a broader range of global victims.

According to the FBI, the collaboration with French partners allowed for testing and confirming the effectiveness of sending commands to delete PlugX from infected devices. The malware variant spreads through computer USB ports, infecting attached USB devices, and potentially spreading to other Windows-based computers once the USB device is plugged in. After infection, the malware stays on the computer and communicates with a command-and-control server, which has a difficult-to-change IP address. The server can then send commands to the malware on the victim's device.