DOJ confirms FBI operation that mass-deleted Chinese malware from thousands of US computers

U.S. and French authorities, assisted by cybersecurity firm Sekoia, conducted a court-authorized operation in August 2024 to remove the PlugX malware used by the China-backed APT group Twill Typhoon (aka Mustang Panda). PlugX, in use since at least 2014 and attributed to state-backed espionage, reportedly infected millions worldwide and was deleted from thousands of U.S. systems as part of the disruption effort targeting government, private sector, and dissident organization compromises.