>
Palo Alto Networks’ Unit 42 team uncovered a range of tools and malware samples in a recent Black Basta breach, where one particularly nasty train received particular attention.
The campaign uses years-old PlugX malware to infect removable USB drives, which can affect any Windows host they are connected to.
Apparently the campaign has been around for over a decade and was initially attributed to Chinese hacker groups, but it has supported an “evolving range of capabilities over the years”, making it very difficult to attribute threats to any particular group or individual.
PlugX USB malware
In this latest iteration, researchers found that it can go almost unnoticed even on the latest version of Windows, to the point where malicious files “can only be viewed on a Unix-like operating system or by mounting the USB device in a forensic tool. “
It hides files by using a certain Unicode character, which prevents Windows Explorer and the command shell from showing users the USB directory structure, effectively hiding files it has copied from its host. It has been found to mainly target Adobe PDF and Microsoft Word files.
The report describes that the malware constantly searches for new removable USB devices, and that victims continue to unknowingly proliferate the PlugX malware thanks to its “new” trickery.
Full details of the findings and the process the malware would follow can be found on Palo Alto Networks’ website (opens in new tab). It also promises to have shared its findings with other members of the Cyber Threat Alliance (CTA), including Avast, McAfee and Sophos.
Its own products are designed to protect users from such attacks, but it urges them to get in touch if they believe they have been infected. In addition, computer users are urged to be wary of suspicious websites, emails and other activities that could be the source of cyber attacks.