Loading story…
The U.S. Department of Justice and FBI said a court-authorized international operation deleted a PlugX malware variant from about 4,258 U.S.-based computers and networks infected by the China-backed group Mustang Panda (also known as Twill Typhoon). Authorities said the malware had been used since at least 2014 against U.S. victims as well as governments, businesses, and dissident groups in Europe and Asia. The disruption was carried out with French law enforcement and Sekoia.io, and the FBI used validated malware-deletion commands under nine warrants obtained in the Eastern District of Pennsylvania before notifying affected owners through internet service providers.
PlugX has long been tied to Chinese cyber-espionage tradecraft, including DLL sideloading, in-memory loading, and remote access capabilities that support persistent access to victim systems. Prior reporting linked Mustang Panda to spear-phishing campaigns against the Hong Kong Catholic Church using archive files and decoy documents to install PlugX, while independent malware analysis showed older PlugX variants remained active with sideloaded components, compressed payloads, and command-and-control infrastructure. The takedown highlights a sustained espionage ecosystem built around PlugX and the continued operational use of the malware across politically sensitive targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The last of the nine warrants expired on Jan. 3, 2025, ending the U.S. portion of the international operation. By then, authorities had deleted PlugX from about 4,258 U.S.-based computers and networks.
In August 2024, the Justice Department and FBI obtained the first of nine warrants in the Eastern District of Pennsylvania authorizing deletion of the Mustang Panda PlugX variant from U.S.-based computers.
PassiveDNS first observed the PlugX command-and-control domain xiguamomomo[.]com, which was later analyzed as part of a PlugX sample using DLL sideloading and reflective loading.
A China-linked spear-phishing campaign targeting members of the Hong Kong Catholic Church began in May, using Vatican- and Catholic-themed lure documents and DLL side-loading to deliver PlugX. Arkbird attributed the samples to Mustang Panda, while Mandiant said the activity was consistent with Chinese state-backed espionage.
Court documents cited by the Justice Department say the PRC-sponsored group Mustang Panda, also known as Twill Typhoon, had used this PlugX variant to infiltrate thousands of systems targeting U.S. victims, European and Asian governments, businesses, and Chinese dissident groups since at least 2014.
The Justice Department and FBI announced a court-authorized, multi-month international operation led with French law enforcement and Sekoia.io to remove a Mustang Panda PlugX variant from thousands of infected computers. The FBI also said it was notifying affected U.S. owners through internet service providers.
Mandiant published analysis of SNOWYDRIVE, SOGU, FROZENHILL, and ZIPZAG, describing removable-media propagation, persistence, and command capabilities. The report also released YARA and YARA-L hunting rules plus file and network indicators of compromise.
A public analysis detailed a PlugX sample delivered by a dropper that extracted WinHelp32.exe, rscom.dll, and rscom.dll.dat, then used DLL sideloading, in-memory decompression, and svchost.exe injection. The decoded configuration exposed command-and-control infrastructure including xiguamomomo[.]com and related IP addresses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
pyaeheinnkyaw.com
Open sourcejustice.gov
Open sourcecloud.google.com
Open sourcecyberandramen.net
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026
The FBI said it remotely removed **PlugX malware** from more than **4,200 U.S. computers** after obtaining court authorization to dismantle infrastructure tied to a long-running Chinese cyber campaign. The malware, commonly associated with Chinese state-backed operators, had infected mostly small office and home office devices, and the bureau deleted the malicious files without collecting personal data from victims. Reporting put the total at **4,258 systems**, underscoring the scale of the cleanup operation against a botnet that had quietly persisted on U.S. networks. U.S. authorities later expanded the crackdown by unsealing charges against **12 Chinese nationals** and seizing domains linked to a broader espionage and hacker-for-hire ecosystem associated with **Silk Typhoon** (also tracked as **APT27** and formerly **Hafnium**). Prosecutors alleged that China’s security services used contractors, including **i-Soon**, to hack U.S. government agencies and other prominent targets, charging state customers roughly **$10,000 to $75,000 per compromised email inbox** and tying the activity to intrusions spanning more than a decade, including the **U.S. Treasury** breach. Italian authorities subsequently arrested an alleged Silk Typhoon-linked suspect wanted over cyberespionage tied to COVID-19 vaccine research.
Jun 29, 2026
Researchers reported that the China-linked espionage group **Mustang Panda** (`TA416`, `RedDelta`, `PKPLUG`) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files. The intrusions delivered a previously undocumented **Korplug/PlugX** variant dubbed **Hodur**, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as **SmadAV**, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with **RC4**, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Aug 15, 2026