FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers

FBI Neutralizes PlugX Malware Using Its Own Self-Destruct Feature

In an unprecedented collaboration, the FBI and French law enforcement have successfully removed the PlugX malware from over 4,200 computers in the United States. Leveraging the malware’s innate self-delete mechanism, authorities dismantled this notorious China-linked remote access trojan (RAT) without affecting legitimate operations.

Innovative Malware Removal Tactic

Investigators gained legal access to a command-and-control (C2) server, allowing them to activate self-deletion commands within the malware. This operation involved cooperation with the French cybersecurity firm Sekoia.io and targeted Mustang Panda, a cyber espionage group reportedly aligned with Chinese state interests.

Background on PlugX Malware

PlugX, active since 2008, is designed to take control of compromised computers, enabling data theft, screen captures, and system management. The malware has been associated with campaigns targeting various groups, including dissidents and governments.

Official Statements and Operation Details

As detailed in an affidavit, French authorities accessed a C2 server and exploited PlugX's self-deletion feature to eliminate the threat. The FBI, after validating this method's effectiveness, ensured it did not disrupt legitimate computer operations. While computer owners remained unaware during the operation, the FBI has since coordinated with Internet Service Providers to inform affected users.

Authorized Court Action

Starting in August 2024, the Justice Department obtained multiple warrants in the Eastern District of Pennsylvania to authorize PlugX removal from U.S. systems, concluding on January 3, 2025. This initiative eradicated the malware from approximately 4,258 U.S.-based computers and networks.

Cyber Espionage and Implications

The Mustang Panda group, reportedly funded by the Chinese government, utilized PlugX to attack systems across the U.S., Europe, and Asia, often leaving victims unaware of their compromised status.