Loading story…
The FBI said it remotely removed PlugX malware from more than 4,200 U.S. computers after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at 4,258 systems, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks.
U.S. authorities later expanded the crackdown by unsealing charges against 12 Chinese nationals and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with Silk Typhoon (also tracked as APT27 and formerly Hafnium). Prosecutors alleged that China’s security services used contractors, including i-Soon, to hack U.S. government agencies and other prominent targets, charging state customers roughly $10,000 to $75,000 per compromised email inbox and tying the activity to intrusions spanning more than a decade, including the U.S. Treasury breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Italian authorities arrested an alleged Silk Typhoon operative accused in cyber-espionage activity related to COVID-19 vaccine targets. The arrest was reported in July 2025 as a new law-enforcement action connected to the campaign.
The U.S. State Department offered rewards of up to $2 million for information leading to the arrest or conviction of alleged Silk Typhoon members Yin KeCheng and Zhou Shuai. The reward announcement accompanied the March 2025 law-enforcement disclosures.
Microsoft released a report stating that Silk Typhoon continued targeting IT companies and government agencies. The report coincided with the U.S. indictments and added current technical and attribution context to the campaign.
Alongside the indictments, U.S. authorities seized internet domains tied to the Silk Typhoon-linked espionage and hacker-for-hire campaign. The action was part of the broader March 2025 disruption and attribution effort.
U.S. authorities announced criminal charges against 12 Chinese nationals linked to a long-running Chinese espionage and hacker-for-hire operation associated with Silk Typhoon, also known as APT27/Hafnium. Prosecutors said the campaign involved contractors and i-Soon working on behalf of Chinese security services.
The FBI announced it had removed Chinese PlugX malware from roughly 4,200 to 4,258 infected U.S. computers using a court-authorized operation. The action was publicly disclosed in mid-January 2025.
A variant of the Chinese-linked PlugX malware infected more than 4,200 U.S. computers, forming the basis for a later FBI court-authorized removal operation. The affected systems were described in January 2025 reporting as 4,200 to 4,258 devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcetheregister.com
Open sourcetechtarget.com
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice and FBI said a court-authorized international operation deleted a **PlugX** malware variant from about **4,258 U.S.-based computers and networks** infected by the China-backed group **Mustang Panda** (also known as **Twill Typhoon**). Authorities said the malware had been used since at least 2014 against U.S. victims as well as governments, businesses, and dissident groups in Europe and Asia. The disruption was carried out with French law enforcement and Sekoia.io, and the FBI used validated malware-deletion commands under nine warrants obtained in the Eastern District of Pennsylvania before notifying affected owners through internet service providers. PlugX has long been tied to Chinese cyber-espionage tradecraft, including **DLL sideloading**, in-memory loading, and remote access capabilities that support persistent access to victim systems. Prior reporting linked Mustang Panda to spear-phishing campaigns against the Hong Kong Catholic Church using archive files and decoy documents to install PlugX, while independent malware analysis showed older PlugX variants remained active with sideloaded components, compressed payloads, and command-and-control infrastructure. The takedown highlights a sustained espionage ecosystem built around PlugX and the continued operational use of the malware across politically sensitive targets.
Aug 15, 2026
The U.S. Department of Justice charged seven international defendants, including five alleged members of **APT41**, over computer intrusion campaigns that hit more than 100 victims worldwide. Prosecutors said the group targeted universities, software developers, telecommunications providers, social media companies, video game firms, nonprofits, and foreign governments, stealing source code, customer account data, and personally identifiable information while pursuing both **espionage** and **financial gain**. The indictments describe activity ranging from supply-chain compromises and credential theft to fraud involving in-game currency and other monetization schemes. Reporting tied the charged activity to broader APT41 operations, including **ColdLock** ransomware attacks against Taiwanese organizations, especially in the energy sector. In those intrusions, attackers were observed using **Active Directory Group Policy**, scheduled tasks, **SMB**, **PowerShell**, customized loaders, and **Cobalt Strike** to move laterally and deploy ransomware. Trend Micro said related activity also affected energy, retail, and telecommunications organizations in Southeast Asia, with infrastructure overlaps and targeting patterns suggesting links between criminal operations and Chinese state-aligned espionage.
Aug 14, 2026
Chinese state-sponsored threat actors have launched a sophisticated spearphishing campaign targeting government and aviation agencies across Europe, including a Serbian aviation agency. The attackers crafted malicious emails that appeared to be related to European government business, enticing recipients to click on links that redirected them to fraudulent Cloudflare verification pages. These fake pages were designed to deliver malware payloads, specifically PlugX, Sogu, and Korplug, which are commonly associated with Chinese cyberespionage groups. The campaign began in late September and has affected organizations in Serbia, Italy, Belgium, Hungary, and the Netherlands. Security researchers have attributed the activity to Chinese APTs, with some overlap in tactics and malware families used by groups such as Mustang Panda and UNC6384. The PlugX malware, a remote access trojan, enables attackers to exfiltrate sensitive data and maintain persistent access within compromised networks. The campaign's use of legitimate-looking Cloudflare lures increases the likelihood of successful credential harvesting and malware deployment. In response to the widespread use of PlugX, U.S. law enforcement, including the Justice Department and FBI, conducted operations to remove the malware from thousands of infected computers in the United States. The campaign demonstrates a high level of operational security, leveraging tailored phishing lures and multi-stage infection chains to evade detection. Security researchers have noted that the attackers continuously adapt their techniques, making use of current events and trusted brands to increase the credibility of their phishing emails. The deployment of multiple malware families in a single campaign suggests a broad espionage objective, targeting both information theft and long-term access. The campaign's cross-border nature highlights the global reach of Chinese cyberespionage operations. Organizations are advised to implement robust email filtering, user awareness training, and endpoint detection to mitigate the risk of similar attacks. The incident underscores the persistent threat posed by Chinese APTs to critical infrastructure and government entities worldwide. Ongoing analysis by cybersecurity firms continues to reveal new indicators of compromise and evolving tactics associated with this campaign. The use of PlugX and related malware remains a hallmark of Chinese cyberespionage, with attackers refining their delivery methods to bypass traditional security controls. The campaign's discovery has prompted increased collaboration between international law enforcement and private sector security teams to disrupt the threat and protect targeted organizations.
Jun 29, 2026