FBI Deletes More Than 4,000 PlugX Malware Instances

U.S. federal law enforcement said Tuesday it deleted more than 4,000 instances of malware used in a Chinese cyberespionage operation after a European partner gained control of the malware’s command and control server.

See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction

The malware “PlugX” is a remote access Trojan used by multiple threat actors – in this case, by a Beijing-backed group tracked as Twill Typhoon or Mustang Panda. The Department of Justice described the group as a government contractor, one of many private sector corporations in a burgeoning hack-for-hire market cultivated by the authoritarian country’s rulers (see: Sophos Discloses Half Decade of Sustained Chinese Attack).

PlugX spreads through infected USB drives. Previous research has noted its reliance on DLL sideloading, a hacking technique that takes advantage of how Microsoft Windows calls software libraries to run applications. The malware is built to accept a number of commands, including a command to delete itself. The FBI, acting with the French police, sent such a command to 4,258 computers based in the U.S. in an operation that began in August 2024.

The malware takes steps not to reveal itself, meaning that notification of the operation to victims sent by the FBI through internet service providers might be victims’ first inkling that Chinese malware was active on their computer.

The U.S. government is embroiled in a decades-long effort to fend off Chinese hackers from intellectual property theft and outright espionage, a fight that publicly turned more urgent after the federal government said Beijing has been prepositioning hacking tools on American critical infrastructure (see: Chinese State Hacker ‘Volt Typhoon’ Targets Guam and US).

Recent notable breaches include Department of the Treasury bureaus dedicated to reviewing foreign investments for national security threats and enforcing sanctions. Just days after the Treasury acknowledged the network penetration, it sanctioned a Chinese tech company for supporting the Beijing hacking group tracked as Flax Typhoon (see: US Sanctions Beijing Company for Flax Typhoon Hacking).

The deletion of the PlugX variant became possible after security researchers found that this variant of PlugX has been hardcoded since September 2023 to use 45.142.166.112 as a command and control server. Cybersecurity company Sekoia in 2023 announced it managed to take ownership of the IP address and began sinkholing malicious traffic. The FBI in an affidavit said it detected at least 45,000 IP addresses connecting to the server from the U.S.

Sekoia offered to collaborate with law enforcement, announcing Dec. 26 that the Paris Public Prosecutor’s Office and the French Gendarmerie National Cyber Unit took them up on the offer (see: French Government Investigates Suspected Chinese Espionage).

In all, 10 countries worked with Sekoia to delete PlugX instances, the company said. “In total, 59,475 disinfection payloads were sent during the campaign, targeting 5,539 IP addresses, sometimes hundreds of times to a single IP address, probably related to VPN exit nodes or SAT links.”