PlugX: Justice Department And FBI Conduct International Operation To Delete Malware Used By China-Backed Hackers

The U.S. Attorney’s Office in Philadelphia released the below information:

PHILADELPHIA – United States Attorney Jacqueline C. Romero, the Justice Department, and the FBI announced today a multi-month law enforcement operation that, alongside international partners, deleted “PlugX” malware from thousands of infected computers worldwide.

As described in court documents unsealed in the Eastern District of Pennsylvania, a group of hackers sponsored by the People’s Republic of China (PRC), known to the private sector as “Mustang Panda” and “Twill Typhoon,” used a version of PlugX malware to infect, control, and steal information from victim computers.

According to court documents, the PRC government paid the Mustang Panda group to, among other computer intrusion services, develop this specific version of PlugX. Since at least 2014, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting U.S. victims, as well as European and Asian governments and businesses, and Chinese dissident groups. Despite previous cybersecurity reports, owners of computers still infected with PlugX are typically unaware of the infection. The court-authorized operation announced today remediated U.S.-based computers infected with Mustang Panda’s version of PlugX.

“This wide-ranging hack and long-term infection of thousands of Windows-based computers, including many home computers in the United States, demonstrates the recklessness and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Romero. “Working alongside both international and private sector partners, the Department of Justice’s court-authorized operation to delete PlugX malware proves its commitment to a ‘whole-of-society’ approach to protecting U.S. cybersecurity.”

“The FBI worked to identify thousands of infected U.S. computers and delete the PRC malware on them. The scope of this technical operation demonstrates the FBI’s resolve to pursue PRC adversaries no matter where they victimize Americans,” said FBI Philadelphia Special Agent in Charge Wayne Jacobs.

The international operation was led by French law enforcement and Sekoia.io, a France-based private cybersecurity company, which had identified and reported on the capability to send commands to delete the PlugX version from infected devices. Working with these partners, the FBI tested the commands, confirmed their effectiveness, and determined that they did not otherwise impact the legitimate functions of, or collect content information from, infected computers.

In August 2024, the DOJ and FBI obtained the first of nine warrants in the Eastern District of Pennsylvania authorizing the deletion of PlugX from U.S.-based computers. The last of these warrants expired on January 3, 2025, thereby concluding the U.S. portions of the operation. In total, this court-authorized operation deleted PlugX malware from approximately 4,258 U.S.-based computers and networks.

The FBI, through the victims’ internet service providers, is providing notice to U.S. owners of Windows-based computers affected by this court-authorized operation.

The FBI’s Philadelphia Field Office and Cyber Division, the U.S. Attorney’s Office for the Eastern District of Pennsylvania, and the National Security Cyber Section of DOJ’s National Security Division led the domestic disruption operation. This operation would not have been successful without the valuable collaboration of the Cyber Division of the Paris Prosecution Office, French Gendarmerie Cyber Unit C3N, and Sekoia.io, a private French cybersecurity technology company.

The FBI continues to investigate Mustang Panda’s computer intrusion activity. If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3). You may also contact your local FBI field office directly; FBI Philadelphia can be reached at 215-418-4000. The FBI strongly encourages the use of antivirus software, as well as the application of software security updates to help prevent reinfection.

FBI/DHS Issues Threat Warning of Copycat Attacks After ISIS-Inspired Vehicle Attack In New Orleans

 Threat of Copycat Attacks after ISIS-Inspired Vehicle Attack in New Orleans

---

Summary

The Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) are issuing this Public Service Announcement to highlight a potential public safety threat from violent extremists in response to the New Year’s Day attack in New Orleans, Louisiana. As with any potential threats to the United States, we will coordinate with our state and local law enforcement partners to ensure they have the resources and information necessary to keep our communities safe.

Threat

The FBI and DHS are concerned about possible copycat or retaliatory attacks due to the persistent appeal of vehicle ramming as a tactic for aspiring violent extremist attackers. Previous attackers inspired by foreign terrorist organizations (FTOs) who have conducted vehicle attacks in the United States and abroad have used rented, stolen, and personally owned vehicles, which are easy to acquire. Some have used additional weapons, such as firearms and knives, to attack individuals after the vehicle has stopped. Additionally, attackers may attempt to conceal and pre-position improvised explosive devices (IEDs) to supplement a vehicle attack. Targets have included pedestrians, law enforcement or military members, and crowded public venues, including festivals and commercial centers, which generally are accessible from roadways. We ask that the public remain vigilant regarding possible copycat or retaliatory attacks and report any suspicious activity to law enforcement.

Resources

• The FBI and DHS encourage the public to promptly report information concerning suspicious activity to tips.fbi.gov or contact their local FBI field office (www.fbi.gov /contact-us/field-offices). Call 911 to report emergencies, including imminent threats to life.
• For concerns involving US citizens abroad, to include reporting missing persons or individuals taken as hostages, please call the Department of State's Overseas Citizens Services (OCS) toll-free hotline at (888) 407-4747 or complete Crisis Intake Form at https://cacms.state.gov/s/crisis-intake.
• To help mitigate potential risks from a variety of threat actors, DHS, the FBI, and the National Counterterrorism Center have compiled resources for law enforcement officers, other first responders, faith leaders, and communities, including a list of funding opportunities, resources for technical assistance, and educational materials.

·          

• Due to the highly personal nature of radicalization to violence and mobilization to violence, it can be difficult to assess specific characteristics indicating the intent of US-based violent extremists to conduct violence. The FBI and DHS urge bystanders to promptly report suspicious activities potentially related to violent extremist activity, including indications of possible online radicalization to violence and mobilization for attacks.
• DHS, the FBI, and NCTC direct public safety partners to the unclassified booklet "US Violent Extremist Mobilization Indicators 2021 Edition," which includes possible indicators of mobilization to violence. These indicators apply to all ideologically motivated, US-based violent extremists. DHS also has developed several unclassified resources for communities to help promote bystander awareness of potentially threatening or concerning behaviors that are observable to others and enhance the capacity to identify and mitigate threats through behavioral threat assessment and management, including publicly available training and prevention guides.
• 

Raymond Chandler And 'The Annotated Big Sleep'

In my previous post, I offered the late, great crime novelist Raymond Chandler’s view of organized crime in America.

As I noted, I have been an admirer of Raymond Chandler since I was a teenager. I’ve read all of his crime novels, short stories, his commentary and several biographies of the writer. 

Back in 2018, I reviewed The Annotated Big Sleep by Raymond Chandler for the Washington Times.

 

You can read the review via the below link:

Paul Davis On Crime: The Annotated Big Sleep: A Look Back At The Late, Great Raymond Chandler And His Classic Crime Novel, 'The Big Sleep' 

Raymond Chandler On Organized Crime in America

I finished rereading Raymond Chandler’s The Long Goodbye last night. 

This is perhaps the fourth or fifth time I’ve read the late, great writer’s crime novel. 

I love Raymond Chandler’s character Philip Marlowe, the private detective, and I love Chandler’s writing, with his vivid descriptions of people. places and things, his striking similes, and his memorable dialogue. 

Forget the Robert Altman film The Long Goodbye (although I have a soft spot for Eliot Gould), Chandler’s novel is more complicated, dark and suspenseful. 

In The Long Goodbye, Chandler has Marlowe give his view of crime in America. 

“We’re a big rough wild people and crime is the price we pay for it, and organized crime is the price we pay for organization,” Marlowe says in the novel. “We’ll have it with us a long time. Organized crime is just the dirty side of the sharp dollar.”      

Note: Above is a photo of James Garner as Philip Marlowe in the 1969 film, Marlowe. He is my favorite Philip Marlowe on film. Garner is big and handsome, smokes a pipe like Marlowe in the novels, and he is very good with the wise cracks. 

You can watch Marlowe via the below link:

Bing Videos

You can also read my Crime Beat column on Raymond Chandler via the below link:  

Paul Davis On Crime: My Crime Beat Column: A Look Back At Raymond Chandler's Influence On Crime Novels And Films 

Government Contractor Agrees To Pay $1M To Resolve False Claims Act Allegations For Submitting Fraudulent Bids On Prime Vendor Contracts

The U.S. Justice Department released the below information:

Johnny Buscema Jr. of New Port Richey, Florida, and his companies, S.A.F.E. Structure Designs, based in Las Vegas, and U.S.A. Manufacturing, based in New Port Richey, have agreed to pay $1,000,000 to resolve allegations that they violated the False Claims Act by causing a prime vendor for the Defense Logistics Agency (DLA) to submit fraudulent contract bids to DLA that resulted in Department of Defense (DoD) customers being overcharged for goods and related services purchased under those contracts. The settlement is based on the settling parties’ ability to pay.

Buscema owns S.A.F.E. Structure Designs, which sells safety equipment to government customers, and USA Manufacturing, a general construction company. Both companies provide third party logistics support, such as product acquisition, receiving, warehousing, transportation, shipping and returns, to military customers through DLA contracts for Maintenance, Repair and Operations (MRO) for the Northeast and Southeast regions of the United States. The MRO contracts covered by the settlement are held by a “prime vendor,” which procures for DoD agencies supplies and equipment, such as chemicals, electrical supplies, hardware, HVAC/refrigeration, prefabricated structures and a variety of small tools. The goal of the MRO program is to achieve favorable product pricing through leveraged buying, infrastructure savings, and inventory cost reductions. To obtain the best price for items procured for the government, the MRO contracts require the prime vendor to engage in a competitive bidding process, soliciting bids from two independently competing vendors for transactions below $25,000 and from three independently competing vendors for transactions at or above $25,000.

The United States alleged that, from 2016 to 2023, the settling parties conspired with other entities to rig bids for awards on the MRO contracts for the Northeast and Southeast regions of the United States. More specifically, Buscema allegedly submitted non-competitive bids, paid other vendors to submit non-competitive bids and submitted multiple bids from his own two companies on the same solicitations to assist the prime vendor to meet its obligation to obtain bids from two or three vendors and to make one of the bids appear more competitive. As a result of these alleged schemes, the United States contends it was overcharged for items purchased under the MRO contracts.

“Those who seek to do business with the government are expected to compete fairly and independently to ensure that the government receives an appropriate price,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division. “The department will hold accountable government contractors that engage in bid rigging or otherwise seek to defraud the American taxpayers.”

“As evidenced in this settlement agreement, these contractors gamed the system to line their own pockets,” said U.S. Attorney Joshua S. Levy for the District of Massachusetts. “They manipulated and undermined the fair and open bidding process designed to save our military — and taxpayers — money. Contractors should be scrupulous in dealing with the government, not coordinating with each other to pad their bottom line. When defense contractors collude, rather than compete, they violate the law and the public’s trust.”

“The DoD expects its contractors to compete in open and fair markets,” said Special Agent in Charge Patrick J. Hegarty of the DoD’s Office of Inspector General’s Defense Criminal Investigative Service (DCIS) Northeast Field Office. “Today’s announcement demonstrates our commitment to work with our law enforcement partners to investigate allegations of anticompetitive practices and ensure the integrity of the DoD’s procurement process.”

“Department of the Army Criminal Investigation Division works diligently to maintain the Army’s readiness and will continue to work closely with our law enforcement partners to prevent and thoroughly investigate fraudulent activity,” said Special Agent in Charge Keith K. Kelly of the Department of the Army Criminal Investigation Division (CID)’s Fraud Field Office. “CID is committed to providing expertise and capabilities supporting whole of government efforts to ensure the U.S. Army remains the most technologically advanced, capable, and ready fighting force in the world.”

The resolution obtained in this matter was the result of a coordinated effort between the Civil Division’s Commercial Litigation Branch, Fraud Section, and the U.S. Attorney’s Office for the District of Massachusetts, with assistance from DCIS, Army CID, Air Force Office of Special Investigations and the General Services Administration Office of Inspector General.

Trial Attorney Samson Asiyanbi of the Justice Department’s Civil Division and Assistant U.S. Attorneys Lindsey Ross and Brian LaMacchia for the District of Massachusetts handled the matter.

The claims resolved by the settlement are allegations only. There has been no determination of liability. 

Note: I worked for the Defense Logistics Agency (DLA) after I was separated from the U.S. Navy. 

I worked for DLA's Defense Contract Administration Region Philadelphia (DCASR Philadelphia), which oversaw defense contractors in Delaware, Eastern PA and South Jersey. 

DCASR and its field offices Defense Contract Administration Services Managment Areas (DCASMA) later became a separate agency called the Defense Contract Managment Agency (DCMA) and broke off from DLA. 

You can read about the huge bribery and contractor scandal at DLA/DCASMA via the below link:

Paul Davis On Crime: A Look Back At The Multi-Million Dollar Defense Contract Fraud and Bribery Case At The Philadelphia Quartermaster 

Schools Need Metal Detectors To Prevent Classroom Shootings

Broad & Liberty ran my piece on school metal detectors.

You can read the piece via the below link or the below text:

Paul Davis: Schools need metal detectors to prevent classroom shootings

I was a student at South Philadelphia High School in the late 1960s. Southern, as the school was called locally, was a rough school back then. Race relations in Philadelphia were at an historical low and there were fights in the school nearly every day between black and white students. There were stabbings and even murders in the school and in the surrounding area of Broad and Snyder Avenue. 

The school was so tough that we joked that Southern’s student newspaper had an obituary column. We joked that student photos were front and side mugshots. We also joked that Southern prepared students for later life. True. Many former Southern students, like me, were shipped off to Vietnam. 

I recall the day after Martin Luther King was murdered in 1968. There were huge gangs that invaded the school and there were large-scale fights in the school, on the street, and in the stores and eateries around the school. Only the presence of the Philadelphia Police arriving in force quelled the fighting.    

I believe it was soon after the riots that the school installed a metal detector, and students were only able to enter the school through the main entrance and through the metal detector. The metal detector stopped students from bringing in guns, knives and other metal weapons. 

Sometime after the installation of the metal detector, I was cutting class and walking in the hallway when a black student intentionally bumped into me. I shoved him back and went into my boxer’s stance. As an amateur middleweight boxer, I had a mean right cross. The black student reached behind his back, and I thought he was going to pull a knife. He didn’t. He pulled out a sword. A three-foot-long sword. 

I raised two fingers and gave him the international peace symbol and said, “Peace, brother.” He laughed and I laughed, and we went our separate ways.

I’m not sure how my hallway opponent was able to bring in a sword, but the metal detector did in fact work to reduce serious violence in the school.

Which brings me to the shooting at the Abundant Life Christian School in Madison, Wisconsin on December 16 of last year. I’ve been following the story and I’ve not seen or read anything yet on the school’s security, if they indeed had any at all. I wonder if they had an armed security officer or a metal detector.  

The Madison Police issued a report on the shooting on December 18^. The report stated that two people died and six others were injured during the shooting. The police stated evidence suggests the shooter died from a self-inflicted gunshot wound.

The shooter was identified as 15-year-old Natalie L. Rupnow, who went by the name Samantha. She was a freshman at the Abundant Life Christian School, and she was from Madison. The shooting happened inside a study hall classroom full of students from mixed grades. This classroom was located on the second floor of the school. One person outside the classroom was also injured after a bullet entered an adjacent room. 

The police reported that a teenage student and a substitute teacher, who was employed part time by the school, were shot and killed. Two students were taken to the hospital with life-threatening injuries. A teacher and three other students were taken to the hospital with non-life-threatening injuries.

Rupnow used a handgun. Two firearms were recovered at the school, but only one was used during the shooting. (Of course, President Biden’s knee-jerk reaction was to call once again for a ban on “assault” rifles, even though Rupnow used a handgun). 

“Detectives are still working to identify a motive in this shooting. They are looking into Rupnow’s social media activity, her relationships with students at the school and her family and working to learn about her behavior prior to Monday’s shooting,” the Madison Police stated. “At this time, there is nothing to suggest this played a role in motive. Defining the motive remains a top priority. There appears to be a combination of many factors right now. 

“We’ll share this information at a later time when it will not jeopardize the investigation. As in any investigation, detectives are looking at the suspect’s online and social media activity. We are aware of a document and possible images of the shooter being floated around online. We currently cannot verify their authenticity. Nor can we confirm any social media accounts potentially belonging to the student due to the ongoing investigation. We ask the public not to share any images or spread false information regarding this investigation. Detectives are working hard to determine the motive for the attack. If they are able to discover this, it may provide insight into whether there were specific targets. Everyone was targeted; everyone was put in equal danger.”

All schools should have armed security officers, in my view, but an armed security officer could not have prevented the troubled young girl from bringing in two handguns. But a metal detector could have.

State and federal grants should be provided to all schools so they can hire armed security officers and have metal detectors installed. One can’t put a price on a teacher or a student’s life. 

Paul Davis, a Philadelphia writer and frequent contributor to Broad + Liberty, also contributes to Counterterrorism magazine and writes the “On Crime” column for the Washington Times. He can be reached at pauldavisoncrime.com.     

FBI/ATF Joint Investigative Update On Bourbon Street Attack

 The FBI Released the below information:

Federal Bureau of Investigation (FBI) personnel from across the country continue to work diligently to further this investigation and evaluate evidence, interview victims and witnesses, and analyze tips related to the New Orleans Bourbon Street attack. Two days into the investigation, the FBI has received almost 1,000 tips, and leads have been sent to FBI field offices across the country for investigation.

As of Thursday, January 2, 2025, all evidence recovery along Bourbon Street and at a short-term rental home on Mandeville Street in New Orleans used by subject Shamsud-Din Jabbar has been completed. At the Mandeville Street location, bomb-making materials—which were rendered safe—and other items were found and collected for further processing. FBI special agents located similar materials at the search of Jabbar’s home on Crescent Peak Drive in Houston, Texas. 

On January 1, at 5:18 a.m. CST, the New Orleans Fire Department (NOFD) responded to a fire at the Mandeville Street location after the attack on Bourbon Street. The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has determined that Jabbar was the only person who could have had access to the residence when the fire was set. ATF also determined that Jabbar set a small fire in the hallway and strategically placed accelerants throughout the house in his effort to destroy it and other evidence of his crime. After Jabbar left the residence, the fire burned to a point that it extinguished itself prior to spreading to other rooms. The ATF investigation revealed that when the NOFD arrived at the scene, the fire was smoldering, allowing for the recovery of evidence, including pre-cursors for bomb-making material and a privately made device suspected of being a silencer for a rifle. 

Evidence collected from multiple sites are being evaluated to further the investigation. The FBI assesses that, during his attack on Bourbon Street, Jabbar intended to use a transmitter, which was found in the F150 truck, to detonate the two IEDs he placed on Bourbon Street. The transmitter, along with two firearms connected to Jabbar, is being transported to the FBI Laboratory for additional testing, as well as clothing and shell casings from the truck. FBI personnel are also evaluating terabytes worth of video and other data collected by street cameras monitored by the New Orleans Real Time Crime Center.  

The FBI continues to surge resources from across the country to assist the New Orleans Field Office. In addition to FBI special agents and personnel based in Louisiana, more than 200 additional personnel have been brought in to assist in this investigation in order to process evidence, support victims, and investigate leads and tips. Personnel support includes, but is not limited to, special agents, victim specialists, evidence technicians, specially trained crisis management personnel, and intelligence analysts. 

FBI victim specialists and special agents continue to interview survivors and witnesses. As of January 3, the FBI has identified 35 known injured individuals. The number of injured is expected to rise in the coming days as additional people either take themselves to hospitals with injuries or ask for assistance from the FBI. Fourteen innocent people were killed in the attack. Courageous New Orleans Police Department officers shot and killed Jabbar after he opened fire on them and the crowd on Bourbon Street. 

For updates, visit www.fbi.gov/bourbonstreetupdates.