Malware

BadUSB

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence2

The malware they created, called BadUSB, can be installed on a USB device to completely take over a PC... Because BadUSB resides not in the flash memory storage of USB devices, but in the firmware that controls their basic functions...

T1200Hardware AdditionsEvidence2

It can even impersonate a USB keyboard to suddenly start typing commands.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

It can even impersonate a USB keyboard to suddenly start typing commands. “It can do whatever you can do with a keyboard, which is basically everything a computer does,” says Nohl.

T1574Hijack Execution FlowEvidence1

It can, for example, replace software being installed with with a corrupted or backdoored version.

Persistence

3 techniques

T1112Modify RegistryEvidence1

The malware can silently hijack internet traffic too, changing a computer's DNS settings to siphon traffic to any servers it pleases.

T1542Pre-OS BootEvidence2

Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

Stealth

2 techniques

T1542Pre-OS BootEvidence2

Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.

T1574Hijack Execution FlowEvidence1

It can, for example, replace software being installed with with a corrupted or backdoored version.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

The malware can silently hijack internet traffic too, changing a computer's DNS settings to siphon traffic to any servers it pleases.

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

Credential Access

2 techniques

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

T1557Adversary-in-the-MiddleEvidence2

Or if the code is planted on a phone or another device with an internet connection, it can act as a man-in-the-middle, secretly spying on communications as it relays them from the victim’s machine.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence2

Collection

1 technique

T1557Adversary-in-the-MiddleEvidence2

Or if the code is planted on a phone or another device with an internet connection, it can act as a man-in-the-middle, secretly spying on communications as it relays them from the victim’s machine.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

osint team blogNews

Jul 18, 2026

Medium

BadUSB is described as a malicious USB-based attack technique in which compromised hardware impersonates trusted USB devices such as keyboards to inject commands, download payloads, and execute them rapidly on a connected device.

web archiveNews

Jul 31, 2014

Why the Security of USB Is Fundamentally Broken | Threat Level | WIRED

A proof-of-concept malicious firmware attack for USB devices that resides in device firmware rather than flash storage, enabling persistent and stealthy compromise. It can impersonate input devices, alter installed files, hijack DNS or internet traffic, and spread between computers and USB devices via firmware reprogramming.

wired com securityNews

Jul 31, 2014

Why the Security of USB Is Fundamentally Broken | WIRED

Malicious firmware for USB devices that persists in the device controller rather than flash storage, enabling hidden compromise, file tampering, keyboard impersonation, DNS hijacking, and man-in-the-middle traffic interception.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

BadUSB

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence2

T1200Hardware AdditionsEvidence2

It can even impersonate a USB keyboard to suddenly start typing commands.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

It can even impersonate a USB keyboard to suddenly start typing commands. “It can do whatever you can do with a keyboard, which is basically everything a computer does,” says Nohl.

T1574Hijack Execution FlowEvidence1

It can, for example, replace software being installed with with a corrupted or backdoored version.

Persistence

3 techniques

T1112Modify RegistryEvidence1

The malware can silently hijack internet traffic too, changing a computer's DNS settings to siphon traffic to any servers it pleases.

T1542Pre-OS BootEvidence2

Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

Stealth

2 techniques

T1542Pre-OS BootEvidence2

Their central finding is that USB firmware, which exists in varying forms in all USB devices, can be reprogrammed to hide attack code.

T1574Hijack Execution FlowEvidence1

It can, for example, replace software being installed with with a corrupted or backdoored version.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

The malware can silently hijack internet traffic too, changing a computer's DNS settings to siphon traffic to any servers it pleases.

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

Credential Access

2 techniques

T1556Modify Authentication ProcessEvidence1

The malware can silently hijack internet traffic too, changing a computer’s DNS settings to siphon traffic to any servers it pleases.

T1557Adversary-in-the-MiddleEvidence2

Or if the code is planted on a phone or another device with an internet connection, it can act as a man-in-the-middle, secretly spying on communications as it relays them from the victim’s machine.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence2

Collection

1 technique

T1557Adversary-in-the-MiddleEvidence2

Or if the code is planted on a phone or another device with an internet connection, it can act as a man-in-the-middle, secretly spying on communications as it relays them from the victim’s machine.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

Why the Security of USB Is Fundamentally Broken | Threat Level | WIRED

wired com securityNews

Jul 31, 2014

Why the Security of USB Is Fundamentally Broken | WIRED

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.