Photo credit: www.yahoo.com

U.S. Authorities Eliminate Chinese Malware from Thousands of Computers

On January 14, federal officials revealed that they successfully eradicated a strain of Chinese malware from numerous computers across the United States.

The malicious software, identified as a form of PlugX, was associated with Mustang Panda, a hacking group reportedly backed by the Chinese government, also referred to as Twill Typhoon. According to court documents, this malware infiltrates systems via USB ports, targeting Windows-based devices.

Once installed, the malware grants hackers the ability to steal files and sensitive information from infected systems.

The documents indicate that the cybercrime group has operated this malware since 2014. The FBI has alleged that Mustang Panda receives funding from the Chinese government for its cyber intrusion efforts, predominantly utilizing the PlugX software.

As noted in the court filings, “The FBI’s extensive investigation into Mustang Panda has unveiled that this group has compromised the systems of various governmental and private entities, notably within the U.S.” The hacking targets have included European shipping companies, various governments in Europe, international groups opposed to the Chinese Communist Party, and several nations in the Indo-Pacific region, including Taiwan.

In collaboration with a French law enforcement agency, which developed a method to operationally disrupt computers affected by this specific PlugX variant, the FBI executed nine warrants as early as August 2024, successfully removing the malware from 4,258 computers and networks within the U.S.

The court documents explain that commands dispatched to the compromised computers were designed to eliminate the files associated with the PlugX malware, erase registry keys that facilitated the automatic execution of the malware, create temporary scripts for its removal, halt the malware’s operation, and ultimately delete the PlugX software and its related components.

The final warrant in this series expired on January 3, as stated by the Justice Department.

“This operation, similar to recent efforts against other Chinese and Russian cyber groups, underscores the importance of robust partnerships in combating malicious cyber behaviors,” said Assistant Attorney General Matthew Olsen of the Justice Department’s Security Division in a statement.

He also expressed gratitude towards the French government and private sector for their leadership in this global cybersecurity initiative.

Source
www.yahoo.com