The malware receives commands via a control server, one of which the FBI gained access to with the help of the French authorities in order to identify the IP addresses of PlugX-affected computers.