French Authorities Lead Major Operation to Eliminate PlugX Malware from Infected Systems

French judicial authorities, in collaboration with Europol, have initiated a large-scale “disinfection operation” aimed at purging the notorious PlugX malware from compromised systems. This concerted effort, spearheaded by the Paris Prosecutor’s Office, Parquet de Paris, began on July 18 and is anticipated to continue for several months, marking a substantial commitment to mitigating the threat posed by this persistent cyber menace.

A Collaborative Effort Across Europe

The operation has already delivered positive outcomes, with around a hundred victims across France, Malta, Portugal, Croatia, Slovakia, and Austria benefiting from the cleanup efforts. The extensive geographical reach of this initiative underscores the collaborative spirit and the shared objective of fortifying cybersecurity defenses across Europe.

This development follows a significant breakthrough by French cybersecurity firm Sekoia, which, in September 2023, successfully sinkholed a command-and-control (C2) server associated with PlugX. Remarkably, this pivotal action was achieved by spending a mere $7 to acquire the IP address linked to the server. The move was crucial in intercepting nearly 100,000 unique public IP addresses that were sending PlugX requests daily to the seized domain.

Understanding PlugX: A Persistent Cyber Threat

PlugX, also known as Korplug, is a remote access trojan (RAT) that has been a favored tool of China-nexus threat actors since at least 2008. Alongside other notorious malware families like Gh0st RAT and ShadowPad, PlugX has been instrumental in numerous cyber espionage campaigns. The malware is deployed within compromised hosts using DLL side-loading techniques, enabling threat actors to execute arbitrary commands, upload and download files, enumerate files, and harvest sensitive data.

The backdoor was initially developed by Zhao Jibin, also known as WHG, and has evolved into various variants over the years. The PlugX builder was shared among several intrusion sets, many of which are attributed to front companies linked to the Chinese Ministry of State Security. This sharing has facilitated the malware’s widespread use and adaptation.

Challenges in Tackling PlugX

One of the notable features of PlugX is its wormable component, which allows it to propagate via infected USB drives, effectively bypassing air-gapped networks. Sekoia, which has been at the forefront of developing solutions to combat PlugX, noted that variants of the malware with the USB distribution mechanism include a self-deletion command (“0x1005”) to remove themselves from compromised workstations. However, removing the malware from the USB devices themselves remains a challenge.

Sekoia highlighted two significant issues: the worm’s ability to exist on air-gapped networks, making such infections difficult to reach, and its capacity to reside on infected USB devices for extended periods without being connected to a workstation. These factors complicate the complete eradication of the malware.