The Justice Department remotely cleaned thousands of computers infected with Chinese malware

The Department of Justice and the FBI shared today that they completed a project to remove malware used by Chinese hackers from computers in the US. The effort was essentially a court-approved counterattack that remotely removed malware known as PlugX of more than 4200 computers. The agencies will notify U.S. owners of those affected machines about the operation through their Internet service providers.

According to the Department of Justice Press releaseHacking groups known as Mustang Panda and Twill Typhoon received support from the Chinese government to use PlugX to infect, monitor, and collect information from computers outside of China. The action to remove PlugX malware from US computers began in August 2024. It was carried out in cooperation with French authorities and with Sekoia.io, a private cybersecurity company based in France. Sekoia.io has found PlugX malware in more than 170 countries.

The Mustang Panda group has been conducting infiltration efforts around the world since at least 2014. For example, cybersecurity company ESET found that Mustang Panda gained access to the computers of cargo shipping companies in Norway, Greece and the Netherlands in March. And the group was one of several China-linked hacking organizations identified as compromising telecommunications systems across the Asia-Pacific region in information last summer.