FBI Warns Threat Actors Are Mailing Out Malicious Flash Drives

In a somewhat unusual new cybersecurity flash alert, the US Federal Bureau of Investigation is warning for the widespread distribution of malicious USB devices over mail.

According to the FBI, the devices are being dished out by a threat actor and contain malware utilizing the BadUSB attack, abusing an inherent vulnerability in the way the USB firmware works. The BadUSB can allow threat actors to install malware on the victim system quietly and with no additional input from the victim required, beyond plugging in the infected USB drive.

Malicious USB Drives Sent to Companies

The FBI has been warning about those shipments of USB drives, being sent out using regular old United States Postal Service or United Parcel Service. The intended recipients are, of course, not home users with nothing valuable to steal and compromise. The malware-laden USB drives are being sent out to companies and institutions, including transport, insurance, and even defense entities.

According to the information provided, the malicious drives come in two variants. One imitates the US Department of Health and Human Services and comes bundled with Covid-19 guidelines in printed form, together with the USB drive. The other variety spoof Amazon dispatches and contained fake gift cards along with the USB drive.

BadUSB Able to Execute Keystrokes

The threat contained in the infected USBs is significant because they can register on the host system not as an external USB drive, but as a human interface device. This effectively allows the attack executed through the USB drive to input keystrokes. The strings preprogrammed into the attack input Windows PowerShell commands that next download various payloads. Additionally, the malicious tools on the USB drives contain backdoor capabilities.

According to researchers, this current wave of USB drive dispatches is handled by the cybercriminal entity known as FIN7.

The BadUSB attack is not brand new, it was discovered by security researchers about a year ago. However, due to the fact that it simply needs the victim to plug the infected device into a system, it has a very high-risk factor associated with it.

January 10, 2022

Cyclonis Backup

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.