Communist China never rests in its quest to infect American computers with spy and malware, as in this story.
The threat of cyberattack is never far away, be that by Amazon ransomware actors with an impossible-to-recover-from threat, or Windows zero-day exploits and even the hacking of the iPhone USB-C port. Luckily, the Federal Bureau of Investigation is also never far away when it comes to warnings about such attacks and hacker threats. But eyebrows will surely be raised just a little as the FBI and Department of Justice have confirmed that thousands of U.S. computers and networks were accessed to remove malware files remotely. Here’s what you need to know.
The U.S. Department of Justice and the FBI have confirmed that a court-authorized operation allowed the remote removal of malware files from 4,258 U.S.-based computers. The operation, targeting the PlugX malware variant as used by what are said to be China-backed threat actors, was, the Jan. 14 statement said, designed to take down a version of PlugX used by the group known as Mustang Panda or Twill Typhoon, capable of controlling infected computers to steal information.
According to court documents, the DoJ said, the People’s Republic of China government “paid the Mustang Panda group to develop this specific version of PlugX,” which has been in use since 2014 and infiltrated thousands of computer systems in campaigns targeting U.S. victims.
“The FBI acted to protect U.S. computers from further compromise by PRC state-sponsored hackers,”Assistant Director Bryan Vorndran of the FBI’s Cyber Division, said, adding that the announcement “reaffirms the FBI’s dedication to protecting the American people by using its full range of legal authorities and technical expertise to counter nation-state cyber threats.”
Thousands of U.S. computers and networks, estimated at 4,258 by the DoJ, were identified by the FBI in the technical operation to detect and delete the malware threat remotely. The first of nine warrants was obtained in August 2024 in the Eastern District of Pennsylvania authorizing the deletion of PlugX from U.S.-based computers, the last expired on Jan. 3. “The FBI tested the commands, confirmed their effectiveness, and determined that they did not otherwise impact the legitimate functions of, or collect content information from, infected computers,” the statement said.
“This wide-ranging hack and long-term infection of thousands of Windows-based computers, including many home computers in the United States, demonstrates the recklessness and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Jacqueline Romero for the Eastern District of Pennsylvania. “The Department of Justice’s court-authorized operation to delete PlugX malware proves its commitment to a ‘whole-of-society’ approach to protecting U.S. cybersecurity.”
Upon reading this story, I was worried that the FBI had (and courts were authorizing use of) a tool that can break in and control random Windows PCs. While I wouldn’t put it past the FBI these days, the Forbes story left out one important technical detail:
After researchers found out that thousands of infected machines reported to one specific IP address, they managed to seize control over the IP address that served as a Command & Control (C2) server.
In close cooperation with the French authorities, the FBI and Justice Department used this IP address to “sinkhole” the botnet. Sinkholing in this context means that the redirection of traffic from its original destination to one specified by the sinkhole owners. The altered destination is known as the sinkhole.
With control of the sinkhole, a specially configured DNS server can simply route the requests of the bots to a fake C2 server. This provides the controller of the sinkhole with valuable information about the affected systems and an opportunity to send commands to delete the PlugX version from the connecting devices.
OK, that means the FBI only seized control of one specific computer that was already compromised by the exploit. That doesn’t mean the FBI doesn’t have a turnkey computer intrusion tool (logical fallacy alert), but it does mean they didn’t necessarily use such a tool here rather than a single white hat hacking instance to seize control of a single already-compromised PC.
Still, it’s always good to check that your security tools and settings have been updated to catch the latest malware and exploits, foreign or domestic…
(Hat tip: Director Blue.)