Palo Alto Networks’ Unit 42 team has uncovered a series of tools and malware samples in a recent Black Basta breach, with one particularly nasty train gaining particular attention.
The campaign uses years-old PlugX malware to infect removable USB drives, which can go on to affect any Windows host they are connected to.
Apparently existing for more than a decade, the campaign was initially credited to Chinese hacker groups however it has supported an “evolving set of capabilities throughout the years”, rendering it very difficult to attribute threats to any given group or individual.
PlugX USB malware
In this latest iteration, researchers found that it can go almost undetected even on the latest version of Windows, to the point where malicious files “can only be viewed on a Unix-like OS or by mounting the USB device in a forensic tool.”
It hides files by using a certain Unicode character, stopping Windows Explorer and the command shell from showing users the USB directory structure, effectively hiding files that it has copied from its host. It has been found to target primarily Adobe PDF and Microsoft Word files.
The report details that the malware continuously monitors for new USB removable devices, and victims unknowingly continue to spread the PlugX malware thanks to its “novel” trickery.
Full details of the findings, and the process that the malware is said to follow, can be found on Palo Alto Networks’ website (opens in new tab). It also promises to have shared its findings with fellow Cyber Threat Alliance (CTA) members, which includes Avast, McAfee, and Sophos.
Its own products are designed to protect users from such attacks, but it urges them to get in touch if they believe they have been infected. Moreover, computer users are urged to take a cautious approach to suspicious websites, emails, and other activities that could be the source of any cyberattacks.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba