Air-Gapped Systems Targeted with Weaponized USBs

itman · Jun 25, 2018

A cyber-espionage group has been weaponizing presumably secure USB drives to target air-gapped critical systems. The Tick group, discovered by researchers at Palo Alto Networks Unit 42, reportedly targets organizations from Japan and South Korea with custom malware, including Minzen, Datper, Nioupale (aka Daserf), and HomamDownloader.

Though the type of USB drive compromised in the attack was supposed to be certified as secure by the South Korean ITSCC, the Tick group loaded malicious files onto the USBs. The number of drives compromised remains unknown.

“The weaponization of a secure USB drive is an uncommon attack technique and likely done in an effort to spread to air-gapped systems, which are systems that do not connect to the public internet,” Unit 42 wrote. Without possession of a compromised USB drive or access to the malicious file, Unit 42 could not detail all sequences in the attack. Researchers said it is also unclear whether the devices were corrupted through the supply chain or post-manufacturing.
Click to expand...

https://www.infosecurity-magazine.com/news/airgapped-systems-targeted-with/

Palancar · Jun 25, 2018

Further; if anyone runs into evidence I would like to know if Linux Air Gaps (linux on donor and air gap machine) are not susceptible. Many times these weaknesses are designed to work on Windows but won't function on Linux. I am not saying Linux is bullet-proof only that to capture the majority of audience they concentrate on Windows. Less than 1% use linux.

itman · Jun 26, 2018

China-linked Hackers Targeting Air-Gapped Systems: Report

Also known as Bronze Butler, Tick is believed to be based in China and to have been active for at least a decade, although it was detailed for the first time only in April 2016. The group is mainly targeting Japan and South Korea, but variants of their malware were also observed in attacks on organizations in Russia, Singapore, and China.

To date, the group has been observed employing a variety of custom malware families, including Minzen, Datper, Nioupale (aka Daserf), and HomamDownloader.

The malware used in these attacks was designed to target systems running Windows XP or Windows Server 2003, which are older, out-of-support OS versions. Air-gapped systems, Palo Alto says, are commonly used in many countries by government, military, and defense contractors, and other industry verticals.

Although no public reports of the attack were published until now, the malware observed in this incident was likely used many years ago.

“Based on the data collected, we do not believe this malware is part of any active threat campaign,” Palo Alto says.
Click to expand...

https://www.securityweek.com/china-linked-hackers-targeting-air-gapped-systems-report

Log in or Sign up

Air-Gapped Systems Targeted with Weaponized USBs

itman Registered Member

Palancar Registered Member

itman Registered Member

Log in or Sign up

Air-Gapped Systems Targeted with Weaponized USBs

itman Registered Member

Palancar Registered Member

itman Registered Member

Useful Searches