International effort erases PlugX malware from thousands of Windows computers – Source: www.csoonline.com

The US has again taken court-approved action to remove malware from privately-held internet-connected computers across the country, part of an effort by a number of countries to combat infections of a version of the PlugX malware from a Chinese-based group that has infected thousands of Windows machines around the world.

PlugX is a remote access Trojan (RAT) consisting a malicious DLL that can perform a variety of actions on the infected endpoint, including downloading and deploying new modules or plugins.

In a statement Tuesday, the Justice Department and the FBI said that on Jan. 3 that they had concluded a five month effort to quietly delete a version of the PlugX malware from computers in the US.

Through internet service providers, the FBI is now notifying US owners of infected computers of the court-authorized action.

Since September 2023, at least 45,000 IP addresses in the United States alone contacted the command and control (C2) server linked to the malware, the US said in a court document. It didn’t detail what action has been taken in other countries but it does say the international operation was led by French law enforcement and Sekoia.io, a France-based private cybersecurity company that found a way to send commands to delete a particular PlugX version from infected devices.

This version of PlugX included the ability to execute a command to delete itself. The French solution took advantage of that by seizing the C2 server and allowing the delete command to be issued. The US needed a court order to execute the command on identified and infected computers.

“I love seeing these kinds of actions by global law enforcement,” said David Shipley, CEO of Canadian-based cybersecurity awareness firm Beauceron Security. “They’re the next best thing to catching and throwing the crooks behind these online crimes into jail.” 

“In cases where there’s no reasonable chance of successful prosecution, particularly when threat actors are in hostile jurisdictions, breaking up their infrastructure and removing active threats from victims is a great step,” he added. “This is a great example of imposing costs on cyber crime because now they’re going to have to rebuild their botnets. And it’s doing something to protect society.”

A huge milestone

Ed Dubrovksy, chief operating officer of Cypfer, an incident response firm, said the international response “is a huge milestone in fighting malware on computers, and takes an unprecedented step by law enforcement to protect people’s digital assets. However, this operation essentially created what might be a very dangerous precedent, where law enforcement sends possibly unauthorized (by owners of devices) commands to user PCs in order to compel devices to take certain actions. Whether this was undertaken after users provided some sort of consent or not is to be determined, and unknown at this time.”

“No one can argue that malware must be removed, as it may have severe impact on others, not just the infected devices,” he said. “But people place much of their personal and confidential data on such devices and while the notice clearly stated that no privacy was breached by the operation, it would certainly be interesting whether the legal field might interpret the access gained by law enforcement to be within the realm of legal access.” 

“It would certainly be interesting to learn how other experts interpret the actions undertaken and whether a similar end-result could have been achieved by instructing users to delete the malware on their own” he added. 

Mustang Panda

According to US court documents, China paid the Mustang Panda group to develop this specific version of PlugX, which is distributed through infected USB devices. Since at least 2014, the US says, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting US victims, as well as European and Asian governments and businesses, and Chinese dissident groups. 

Cybersecurity companies have been warning for years about Mustang Panda, which some researchers call RedDelta, Bronze President, or Twill Typhoon, and has engaged in espionage activity since at least.

In 2022, Cisco Systems reported that this group had begun phishing campaigns against organizations in Europe and Russia. Some phishing messages contained malicious lures masquerading as official European Union reports on the conflict in Ukraine and its effects on NATO countries. Other phishing emails delivered fake “official” Ukrainian government reports, both of which downloaded malware onto compromised machines.

In 2023, BlackBerry reported Mustang Panda targeting Myanmar to distribute PlugX through phishing messages that allegedly came from a local news outlet.

An effective tactic

Using court approvals to send commands to privately-held computers is an unusual but effective tactic to defang malware when a country feels businesses and individuals aren’t acting fast enough – but only works when local laws allow.

The US first used it in 2021, when it got court approval to remove malicious web shells from hundreds of infected American computers running on-premises versions of Microsoft Exchange Server. In 2023, it used the tactic again to disrupt a global peer-to-peer network of computers compromised by the Snake malware attributed to a unit of Russia’s Federal Security Service. Last year, the US revealed it did it twice: First, to disrupt a botnet of infected small office/home office routers hacked by the China-based hacking group dubbed Volt Typhoon, and later to disinfect a botnet of SOHO routers compromised by a Russian military group known to researchers as ATP28, Fancy Bear, or Forest Blizzard.

International effort

“The Department of Justice prioritizes proactively disrupting cyber threats to protect US victims from harm, even as we work to arrest and prosecute the perpetrators,” Matthew Olsen, US assistant attorney in the Justice Department’s National Security Division, said in a statement. “This operation, like other recent technical operations against Chinese and Russian hacking groups like Volt Typhoon, Flax Typhoon, and APT28, has depended on strong partnerships to successfully counter malicious cyber activity. I commend partners in the French government and private sector for spearheading this international operation to defend global cybersecurity.”

In a statement, French authorities said Sekoia analysts identified and took possession of a command and control server (C2) that ran a network of several million infected machines, including 3,000 in France. In conjunction with C3N, the French police’s center for combating digital crime, it developed a technical solution for remote disinfection of botnet victims. France began quietly disinfecting computers in July. As in the US, businesses and individuals are being notified.

The Sekoia solution was also distributed to other cybersecurity agencies through Europol. The statement said other countries known to have benefited from distributing the solution were Malta, Portugal, Croatia, Slovakia, and Austria.

The US got a court order last August allowing the government to issue commands to infected US-based computers to:

• delete the files created by the PlugX malware on the victim computer;
• delete the PlugX registry keys used to automatically run the PlugX application when the victim computer is started;
• create a temporary script file to delete the PlugX application after it is stopped;
• stop the PlugX application;
• and run a temporary file to delete the PlugX application, delete the directory created on the victim computer by the PlugX malware to store the PlugX files, and delete the temporary file from the victim computer.

The US court order didn’t authorize the collection of any information from infected computers.

Potential issues

A government remotely issuing a command to a computer is “definitely unconventional,” said Will Townsend, vice president and principal analyst at US-based Moor Insights & Strategy, “but given the circumstances (sponsored nation state attack) it’s likely warranted. However, it presents an interesting scenario given there was no end user opt/in or out. What happens if the push renders a PC dead or corrupted? How would a consumer be compensated?

“I suspect that after the dust settles on this action, legislation may be proposed to classify malware threats that warrant similar action in the future. Sort of analogous to a DEFCON [a U.S. military readiness] classification system.”