Researchers sinkhole PlugX malware server with 2.5 million unique IPs

Researchers at Sekoia acquired and sinkholed a PlugX command-and-control IP, observing more than 2.5 million unique IPs and 90k–100k daily connections from infected hosts across 170 countries; the report highlights PlugX's wormable USB propagation, disinfection complexities (including air-gapped and infected removable media), historical use in espionage and criminal activity, and the risk that captured C2 infrastructure could be abused if controlled by others.