[Angel_Batista]

https://www.justice.gov/opa/pr/justice-d...ina-backed

A French law enforcement agency has gained access to the C2 server assigned IP address 45.142.166.112. [...] Working with the French law enforcement agency, the FBI can send the self-delete command to the TARGET DEVICES infected with this variant of PlugX malware. [...] The requested warrant was previously issued on August 28, 2024 and has been reissued on a rolling basis since then. The FBI has counted the daily number of TARGET DEVICES that communicated with the C2 server and were sent the command to self-delete the PlugX malware. As of December 17, 2024, the self-delete command has been sent to thousands of unique IP addresses, with a consistent rate of disinfection.

For 5 months, FBI has been using Mustang Panda's C2 server that was hacked by a "French law enforcement agency" (ANSSI) to remove malware from American computer using commands sent via said C2 server.