BadUSB exploits the USB standard’s versatility and allows an attacker to reprogram a USB drive to, for example, emulate a keyboard to create keystrokes and commands on a computer, install malware prior to the operating system booting, or to spoof a network card and redirect traffic. SEE: Your cybersecurity training needs improvement because hacking attacks are only getting worse While BadUSB attacks aren’t common, cyber criminals in 2020 posted BadUSB drives to targets in the post with a message claiming to be from BestBuy that urged recipients to insert a malicious USB thumb drive into a computer in order view products that could be redeemed from a supposed gift card. That attack was attributed to the FIN7 group, which is also believed to be behind this attack. According to The Record, the FBI warned that the new BadUSB attacks were shipped on LILYGO-branded devices. The mail was delivered in packages to organizations in the transport and insurance sectors from August, while defense industry targets have received the packages since November. The USB drives were configured to register as a keyboard device after being plugged in. They then injected keystrokes into the target PC to install malware. Numerous attack tools were installed that allowed for exploitation of PCs, lateral movement across a network, and installation of additional malware. The tools were used to deploy multiple ransomware strains, including BlackBatter and REvil. BlackMatter is believed to be a rebrand of the DarkSide ransomware group, which appeared to close its business after attacking US fuel distributor Colonial Pipeline in May. This attack prompted discussions between the Biden Administration and the Kremlin over attacks on critical infrastructure.
