Originated from China, a piece of malware has been neutralized following an FBI court mandate to purge the malicious software from thousands of Windows systems.

The agency managed to halt the PlugX malware’s operation within the United States, impacting upwards of 2.5 million devices worldwide by compromising USB drives, reported by PCMag.

In synergy with the FBI, the Justice Department has confirmed receiving judicial approval to eliminate the malware from about 4,260 systems and networks across the U.S. as of Tuesday. Following the announcement, the FBI intends to inform the users of compromised devices through their ISPs.

This is an example of federal units managing a critical cyber threat. Nevertheless, the importance of ongoing cybersecurity research is emphasized by this resolution. The Justice Department conveyed that the perpetrators were a specialized Chinese state-supported hacking team titled “Mustang Panda,” developing a custom PlugX variant for their ongoing activities.

PlugX initially appeared in 2008 as a backdoor vulnerability allowing bad actors covert control over Windows devices. By 2020, updates enabled it to infect not only USB drives but also connected systems. Such “wormable” malware can traverse between systems through compromised peripherals.

The French cybersecurity firm Sekoia discovered Mustang Panda eventually unable to maintain all infected devices, thus abandoning the undertaking.

Equally, Sophos, an antivirus firm, detected numerous PlugX occurrences originating from one IP address. In September 2023, in collaboration with Sekoia, the cybersecurity company spent a mere $7 to access the IP along with affected systems. Further explorations revealed a self-removal directive embedded within the PlugX code.

French law enforcement in July 2024 authorized utilizing the self-erasure tactic to cleanse tumid devices. Consequently, 22 nations have emulated this approach.

Methods for U.S. entities to extract the malware from domestic systems remain undetermined, but the FBI asserted via affidavit that testing of the self-removal directive confirmed it solely purges the malware without affecting other device operations or transmitting any unapproved code.