FBI Warns Threat Actors Are Mailing Out Malicious Flash Drives
In a somewhat unusual new cybersecurity flash alert, the US Federal Bureau of Investigation is warning for the widespread distribution of malicious USB devices over mail.
According to the FBI, the devices are being dished out by a threat actor and contain malware utilizing the BadUSB attack, abusing an inherent vulnerability in the way the USB firmware works. The BadUSB can allow threat actors to install malware on the victim system quietly and with no additional input from the victim required, beyond plugging in the infected USB drive.
Malicious USB Drives Sent to Companies
The FBI has been warning about those shipments of USB drives, being sent out using regular old United States Postal Service or United Parcel Service. The intended recipients are, of course, not home users with nothing valuable to steal and compromise. The malware-laden USB drives are being sent out to companies and institutions, including transport, insurance, and even defense entities.
According to the information provided, the malicious drives come in two variants. One imitates the US Department of Health and Human Services and comes bundled with Covid-19 guidelines in printed form, together with the USB drive. The other variety spoof Amazon dispatches and contained fake gift cards along with the USB drive.
BadUSB Able to Execute Keystrokes
The threat contained in the infected USBs is significant because they can register on the host system not as an external USB drive, but as a human interface device. This effectively allows the attack executed through the USB drive to input keystrokes. The strings preprogrammed into the attack input Windows PowerShell commands that next download various payloads. Additionally, the malicious tools on the USB drives contain backdoor capabilities.
According to researchers, this current wave of USB drive dispatches is handled by the cybercriminal entity known as FIN7.
The BadUSB attack is not brand new, it was discovered by security researchers about a year ago. However, due to the fact that it simply needs the victim to plug the infected device into a system, it has a very high-risk factor associated with it.
