Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

FanJ · Feb 2, 2024

Mandiant - Jan 30, 2024
https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware

Conclusion

Mandiant observed a clear evolution of the TTPs from the early stages of the campaign to its current form.

Starting off with the initial payload served in explorer.ps1, where a custom decoding scheme was developed to the point where it got replaced with asymmetric encryption and the addition of the capability to track infected devices.

Furthermore, the analysis of both EMPTYSPACE and QUIETBOARD suggests how the threat actors took a modular approach in developing their toolset. QUIETBOARD started by only having one module and then more functionality was incrementally added. Similarly, the Python variant of EMPTYSPACE shows clear signs of versioning. The use of multiple programming languages to create different versions of the EMPTYSPACE downloader and the URL change when the Vimeo video was taken down show a predisposition for experimentation and adaptability on the threat actors’ side.
Click to expand...

Read the analysis there.

Log in or Sign up

Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

FanJ Updates Team

Log in or Sign up

Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

FanJ Updates Team

Useful Searches