French Govt Investigating Recent Malware Attack that Compromised 3,000 Machines

The French government has investigated a malware attack that compromised approximately 3,000 machines within the country.

The attack, part of a more extensive botnet operation affecting millions globally, has raised serious concerns about cybersecurity as France prepares to host the upcoming Olympic Games.

Discovery and Initial Response

The investigation began following a report from Sekoia, a cybersecurity firm, that identified the PlugX malware on numerous systems.

PlugX, a Remote Access Trojan (RAT), allows attackers to execute arbitrary commands and steal data from infected machines.

According to the Tribunal De Paris Justice report, the malware was primarily spread through infected USB drives. Sekoia’s analysts managed to locate and take control of a command and control (C2) server that was orchestrating the botnet.

This server was responsible for issuing commands to the infected machines, which numbered millions worldwide.

In France alone, 3,000 machines were compromised, receiving instructions from the C2 server and nearly 100,000 other victims daily.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Coordinated Efforts for Disinfection

Sekoia developed a remote disinfection solution in collaboration with the Centre de Lutte contre les Criminalités Numériques (C3N) of the National Gendarmerie. This solution was designed to cleanse the infected machines of the PlugX malware.

The disinfection operation commenced on July 18, 2024, and is expected to continue for several months.

Within hours of initiating the disinfection process, hundreds of machines were successfully cleaned, most of them located in France.

The operation also extended to other countries, including Malta, Portugal, Croatia, Slovakia, and Austria.

By the end of 2024, the French victims will receive individual notifications from the Agence Nationale de la sécurité des systèmes information (ANSSI) as required by law under article L. 33-14, paragraph 5 of the Postal and Electronic Communications Code.

Importance of Cybersecurity Measures

The French judiciary, led by Prosecutor Laure Beccuau, emphasized the critical importance of maintaining robust cybersecurity practices.

The Paris Prosecutor’s Office highlighted the necessity of using up-to-date antivirus software and other preventive measures to protect against such sophisticated cyber threats.

Sekoia has provided a list of technical indicators related to the malicious network for use by professionals. This proactive approach aims to bolster defenses against future cyberattacks and mitigate the risks posed by similar malware.

As France gears up for the Olympic Games, this operation underscores the vigilance and preparedness of national and international cybersecurity stakeholders. The collaborative efforts between private firms, law enforcement, and international partners demonstrate a unified front against cybercriminal activities.

The French government remains committed to safeguarding its digital infrastructure and ensuring the security of its citizens and international visitors during the high-profile event. 

This article provides a detailed account of the recent malware attack investigation in France, highlighting the discovery, response efforts, and the importance of cybersecurity measures.

The image of cybersecurity experts working on malware analysis adds a visual element to the story, emphasizing the ongoing efforts to combat cyber threats.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo