PlugX worm disinfection campaign feedbacks

In September 2023 researchers sinkholed a PlugX worm C2 (a Mustang Panda-associated worm with flash-drive propagation) and developed two remote disinfection methods and an ergonomic portal to allow national CERTs and law-enforcement partners to remediate infected hosts; cooperating with the Paris Public Prosecutor's Office and the French Gendarmerie National Cyber Unit, they carried out legal, country-specific disinfections resulting in 59,475 disinfection payloads sent to 5,539 IP addresses and established procedures and tooling for sovereign disinfection.