The FBI and Department of Justice (DOJ) successfully removed Chinese state-sponsored malware from over 4,200 computers across the United States. This court-authorized initiative targeted the notorious PlugX malware, which was deployed by a hacking group linked to the Chinese Communist Party (CCP), known as Mustang Panda or Twill Typhoon.

The operation’s success highlights the growing threats posed by state-sponsored cyberattacks and showcases the vital importance of international cooperation in countering these risks. FBI Philadelphia Special Agent in Charge Wayne Jacobs emphasized the significance of the operation, stating, “The scope of this technical operation demonstrates the FBI’s resolve to pursue PRC adversaries no matter where they victimize Americans.”

Who Were the Hackers?

The group behind the attack, Mustang Panda, has been active since at least 2014 and is infamous for its aggressive tactics and advanced cyber capabilities. Sponsored by the CCP, this hacking group has been responsible for numerous campaigns targeting governments, businesses, and dissidents across Asia, Europe, and the United States. According to U.S. Attorney Jacqueline Romero, the attack was “wide-ranging” and “long-term,” showcasing “the recklessness and aggressiveness of PRC state-sponsored hackers.”

PlugX, the malware used in this campaign, has been in operation since 2008. By 2020, it had evolved to include new, troubling capabilities, including the ability to spread through USB flash drives. The malware was described in court filings as capable of “infecting, controlling, and stealing information from victim computers,” making it a potent tool for espionage.

How the Malware Operated

PlugX is a sophisticated remote access Trojan (RAT) designed to give hackers full control over an infected device. Once installed, the malware becomes deeply embedded, persisting even after system restarts. FBI investigators explained that PlugX “maintains persistence in part by creating registry keys which automatically run the PlugX application when the computer is started.”

The malware’s functions include collecting detailed information about the infected computer, such as its IP address and physical location, and enabling hackers to upload, download, move, and delete files. It also communicates with a command-and-control (C2) server, allowing its operators to issue remote commands. Since September 2023, PlugX had interacted with over 45,000 U.S. IP addresses, with many victims unaware that their computers were compromised.

Adding to its danger, PlugX spreads through removable media. If an infected USB drive is connected to another system, the malware can propagate, even to computers not connected to the internet. This feature makes PlugX particularly effective in targeting isolated networks.

The FBI’s International Response

The FBI’s operation to remove PlugX was a collaborative effort involving French law enforcement and the French cybersecurity firm Sekoia.io. Sekoia identified a method to remotely neutralize the malware and shared their findings with international partners. The FBI rigorously tested this method to ensure it would not interfere with the legitimate functions of infected computers.

After confirming the technique’s safety and effectiveness, the FBI obtained nine rolling warrants from the Eastern District of Pennsylvania, authorizing the removal of PlugX from infected systems. The operation, which ran from August 2024 to January 2025, ultimately succeeded in removing malware from 4,258 U.S.-based computers and networks. This effort was described as part of a “whole-of-society” approach to cybersecurity, demonstrating how governments and private companies can work together to counter cyber threats.

Assistant Attorney General Matthew Olsen praised the collaboration, stating, “This operation has depended on strong partnerships to successfully counter malicious cyber activity. I commend partners in the French government and private sector for spearheading this international operation to defend global cybersecurity.”

Why the FBI Acted Without Prior Notification

One controversial aspect of the operation was the decision to act without notifying the owners of infected computers beforehand. The FBI argued that premature disclosure could have given hackers an opportunity to modify the malware or destroy evidence. “Premature disclosure to the public at large or to individual owners of the target devices could result in publicity that would then give the hackers the opportunity to make changes to the malware,” explained an FBI affidavit.

Instead, the FBI notified affected individuals after the operation, using their internet service providers to deliver the messages. The bureau also issued public advisories urging Americans to keep antivirus software updated and apply security patches to prevent reinfection.

The Global Scope of Mustang Panda’s Activities

Mustang Panda’s cyber campaigns extend far beyond U.S. borders. The group has targeted European governments, Indo-Pacific nations, and Chinese dissidents, often focusing on entities involved in China’s Belt and Road Initiative. According to court documents, significant foreign targets included “European shipping companies in 2024, several European governments from 2021 to 2023, and governments throughout the Indo-Pacific,” such as Taiwan, Japan, and South Korea.

PlugX’s reach has been global. In a single day, researchers detected the malware in over 90,000 devices worldwide, with hotspots in the United States, India, and Nigeria. French cybersecurity experts highlighted the challenges posed by the malware’s resilience, noting that “this worm cannot be completely stopped.”

Lessons and Next Steps

The success of this operation underscores the need for vigilance and international cooperation in combating cyber threats. The DOJ has emphasized that this case reflects its commitment to proactively disrupting cyberattacks. “The Department of Justice prioritizes proactively disrupting cyber threats to protect U.S. victims from harm, even as we work to arrest and prosecute the perpetrators,” said Olsen.

Moving forward, individuals and organizations are encouraged to take proactive measures to protect themselves, including:

• Regularly updating antivirus software.
• Applying security patches to operating systems and applications.
• Avoiding the use of unknown USB drives.
• Reporting suspected cyber intrusions to the FBI’s Internet Crime Complaint Center (IC3).

The successful removal of PlugX malware is a significant victory in the fight against state-sponsored cyberattacks. However, it is also a reminder of the persistent danger posed by groups like Mustang Panda. As technology evolves, so too will the strategies employed by hackers, making continued vigilance and innovation essential to safeguarding critical systems and personal data.

The FBI’s multi-year investigation of Mustang Panda will remain ongoing, ensuring that the group’s activities are closely monitored and countered. As Special Agent Wayne Jacobs put it, “Today’s announcement reaffirms the FBI’s dedication to protecting the American people by using its full range of legal authorities and technical expertise to counter nation-state cyber threats.”

ACZ Editor: This is the kind of malware that can array computers inside America into an organized attack on businesses and infrastructure, should they decide to do so. It is a bit disturbing that the FBI can so easily access an individual’s computers, this may develop into our our own problem of oppression in the future.