Wednesday, May 7, 2025
Homecyber securityFrench Govt Investigating Recent Malware Attack that Compromised 3,000 Machines

French Govt Investigating Recent Malware Attack that Compromised 3,000 Machines

Published on

SIEM as a Service

Follow Us on Google News

The French government has investigated a malware attack that compromised approximately 3,000 machines within the country.

The attack, part of a more extensive botnet operation affecting millions globally, has raised serious concerns about cybersecurity as France prepares to host the upcoming Olympic Games.

Discovery and Initial Response

The investigation began following a report from Sekoia, a cybersecurity firm, that identified the PlugX malware on numerous systems.

- Advertisement - Google News

PlugX, a Remote Access Trojan (RAT), allows attackers to execute arbitrary commands and steal data from infected machines.

According to the Tribunal De Paris Justice report, the malware was primarily spread through infected USB drives. Sekoia’s analysts managed to locate and take control of a command and control (C2) server that was orchestrating the botnet.

This server was responsible for issuing commands to the infected machines, which numbered millions worldwide.

In France alone, 3,000 machines were compromised, receiving instructions from the C2 server and nearly 100,000 other victims daily.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Coordinated Efforts for Disinfection

Sekoia developed a remote disinfection solution in collaboration with the Centre de Lutte contre les Criminalités Numériques (C3N) of the National Gendarmerie. This solution was designed to cleanse the infected machines of the PlugX malware.

The disinfection operation commenced on July 18, 2024, and is expected to continue for several months.

Within hours of initiating the disinfection process, hundreds of machines were successfully cleaned, most of them located in France.

The operation also extended to other countries, including Malta, Portugal, Croatia, Slovakia, and Austria.

By the end of 2024, the French victims will receive individual notifications from the Agence Nationale de la sécurité des systèmes information (ANSSI) as required by law under article L. 33-14, paragraph 5 of the Postal and Electronic Communications Code.

Importance of Cybersecurity Measures

The French judiciary, led by Prosecutor Laure Beccuau, emphasized the critical importance of maintaining robust cybersecurity practices.

The Paris Prosecutor’s Office highlighted the necessity of using up-to-date antivirus software and other preventive measures to protect against such sophisticated cyber threats.

Sekoia has provided a list of technical indicators related to the malicious network for use by professionals. This proactive approach aims to bolster defenses against future cyberattacks and mitigate the risks posed by similar malware.

As France gears up for the Olympic Games, this operation underscores the vigilance and preparedness of national and international cybersecurity stakeholders. The collaborative efforts between private firms, law enforcement, and international partners demonstrate a unified front against cybercriminal activities.

The French government remains committed to safeguarding its digital infrastructure and ensuring the security of its citizens and international visitors during the high-profile event. 

This article provides a detailed account of the recent malware attack investigation in France, highlighting the discovery, response efforts, and the importance of cybersecurity measures.

The image of cybersecurity experts working on malware analysis adds a visual element to the story, emphasizing the ongoing efforts to combat cyber threats.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...