MalwareUsed by 3 actorsExploits 3 CVEs

USBCulprit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

USBCulprit ... Spearphishing with malicious RoyalRoad document exploiting one days (CVE-2012-0158, CVE-2017-11882, CVE-2018-0802), then USBCulprit is dropped selectively by the attacker.

via eset welivesecurity blogwelivesecurity.com

CVE-2017-11882Microsoft Office Equation Editor Remote Code Execution VulnerabilityExploited in the wild

USBCulprit ... exploiting one days (CVE-2012-0158, CVE-2017-11882, CVE-2018-0802)... Retro ... Spearphishing with documents that exploit CVE-2017-11882. ... Ramsay ... Malicious RTF documents exploiting ... CVE-2017-11882 (Office RCE).

via eset welivesecurity blogwelivesecurity.com

CVE-2018-0802Microsoft Office Equation Editor Memory Corruption VulnerabilityExploited in the wild

USBCulprit ... Spearphishing with malicious RoyalRoad document exploiting one days (CVE-2012-0158, CVE-2017-11882, CVE-2018-0802), then USBCulprit is dropped selectively by the attacker.

via eset welivesecurity blogwelivesecurity.com

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GOBLIN PANDA

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

Cycldek

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

Conimes

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.

T1566.001Spearphishing AttachmentEvidence1

the methods observed do not differ much from what we see in general malware: emails with malicious attachments, links, or USB worms.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

some frameworks, for example USBFerry, USBCulprit, Retro and PlugX, simply pipe the output of built-in Windows commands (for instance, ipconfig or netstat) to a file that is exfiltrated to the attacker

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

most of the frameworks just employ persistence based in the Windows registry to get executed at system startup

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

most of the frameworks just employ persistence based in the Windows registry to get executed at system startup

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence1

Obtained host network configuration and connectivity capability, limited attempt to get network topology (using ping and tracert)

T1018Remote System DiscoveryEvidence1

used built-in Windows commands such as tracert and ping to determine whether the system they are running on has internet connectivity or not.

T1057Process DiscoveryEvidence1

Frameworks gather information such as computer name, username, domain name, list of running processes

T1082System Information DiscoveryEvidence1

Frameworks gather information such as computer name, username, domain name, list of running processes, listing of files in directories, drives and network shares, as well as network configuration information

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.

Collection

3 techniques

T1005Data from Local SystemEvidence1

USBStealer, USBCulprit, Retro, USBThief, PlugX and Ramsay, for example, were clearly built to steal specific files.

T1074Data StagedEvidence1

collects information that is staged on the USB drive for exfiltration.

T1560Archive Collected DataEvidence1

The files were grouped and archived in a password-protected RAR file

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

the attacker sends commands to the malware placed on the air-gapped network; this is done via a covert communication channel often placed on a USB drive

Exfiltration

1 technique

T1052Exfiltration Over Physical MediumEvidence1

used USB drives as the physical transmission medium to transfer information across air gaps.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelistNews

Sep 3, 2020

IT threat evolution Q2 2020

USB-based data exfiltration tool likely intended to bridge air-gapped environments; delivered as a side-loaded DLL via legitimate signed applications.

eset welivesecurity blogNews

Aug 14, 2026

Espionage malware using primitive USB file-based signaling, selective propagation, document theft, host/network reconnaissance, and optional execution of arbitrary files from USB on air-gapped systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 3 actorsExploits 3 CVEs

USBCulprit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2012-0158MSCOMCTL.OCX ActiveX Controls Remote Code ExecutionExploited in the wild

USBCulprit ... Spearphishing with malicious RoyalRoad document exploiting one days (CVE-2012-0158, CVE-2017-11882, CVE-2018-0802), then USBCulprit is dropped selectively by the attacker.

via eset welivesecurity blogwelivesecurity.com

CVE-2017-11882Microsoft Office Equation Editor Remote Code Execution VulnerabilityExploited in the wild

via eset welivesecurity blogwelivesecurity.com

CVE-2018-0802Microsoft Office Equation Editor Memory Corruption VulnerabilityExploited in the wild

USBCulprit ... Spearphishing with malicious RoyalRoad document exploiting one days (CVE-2012-0158, CVE-2017-11882, CVE-2018-0802), then USBCulprit is dropped selectively by the attacker.

via eset welivesecurity blogwelivesecurity.com

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GOBLIN PANDA

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

Cycldek

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

Conimes

IdentityKit #9: USBCulprit ... Steal documents and network information of compromised computers from government organizations across several Southeast Asian countries ...

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.

T1566.001Spearphishing AttachmentEvidence1

the methods observed do not differ much from what we see in general malware: emails with malicious attachments, links, or USB worms.

Execution

1 technique

T1059.003Windows Command ShellEvidence1

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

most of the frameworks just employ persistence based in the Windows registry to get executed at system startup

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

most of the frameworks just employ persistence based in the Windows registry to get executed at system startup

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence1

Obtained host network configuration and connectivity capability, limited attempt to get network topology (using ping and tracert)

T1018Remote System DiscoveryEvidence1

used built-in Windows commands such as tracert and ping to determine whether the system they are running on has internet connectivity or not.

T1057Process DiscoveryEvidence1

Frameworks gather information such as computer name, username, domain name, list of running processes

T1082System Information DiscoveryEvidence1

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks.

Collection

3 techniques

T1005Data from Local SystemEvidence1

USBStealer, USBCulprit, Retro, USBThief, PlugX and Ramsay, for example, were clearly built to steal specific files.

T1074Data StagedEvidence1

collects information that is staged on the USB drive for exfiltration.

T1560Archive Collected DataEvidence1

The files were grouped and archived in a password-protected RAR file

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

the attacker sends commands to the malware placed on the air-gapped network; this is done via a covert communication channel often placed on a USB drive

Exfiltration

1 technique

T1052Exfiltration Over Physical MediumEvidence1

used USB drives as the physical transmission medium to transfer information across air gaps.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelistNews

Sep 3, 2020

IT threat evolution Q2 2020

USB-based data exfiltration tool likely intended to bridge air-gapped environments; delivered as a side-loaded DLL via legitimate signed applications.

eset welivesecurity blogNews

Aug 14, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.