Loading story…
ESET reported that the Sednit espionage group, also known as APT28/Fancy Bear, used malware designed to breach air-gapped networks by spreading through removable media. The operation relied on USB devices to move malicious components into isolated environments, allowing the attackers to collect data from systems not directly connected to the internet and then exfiltrate it once the infected media was reconnected to an online machine.
The campaign highlighted a deliberate focus on espionage rather than disruption, with tooling tailored to steal documents and system information from sensitive targets. By adapting its tradecraft to bypass physical network isolation, Sednit demonstrated that air gaps alone do not prevent compromise when attackers can exploit trusted workflows involving portable storage and cross-network file transfers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
FireEye released a report on APT28/Sednit, providing additional public technical details and analysis about the espionage group. This is a separate disclosure event from ESET's 2014 reporting on Sednit targeting air-gapped networks.
ESET published research describing the Sednit espionage group attacking air-gapped networks, marking public disclosure of the campaign and its techniques.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceweb.archive.org
Open sourceweb-assets.esetstatic.com
Open sourceregmedia.co.uk
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that **Sednit**—the Russia-linked espionage group also tracked as **APT28/Fancy Bear**—has returned with renewed activity and updated tradecraft. The campaign reflects a continuation of the group's long-running intelligence collection operations, with researchers documenting refreshed malware and intrusion techniques designed to regain footholds in targeted environments and support covert data theft. The report indicates the operators are back to conducting targeted intrusions against organizations of strategic interest, relying on stealthy persistence and modular tooling to maintain access while evading detection. The findings reinforce that Sednit remains an active and capable state-aligned threat actor, and that defenders should expect ongoing spearphishing, credential theft, and post-compromise lateral movement associated with the group's espionage playbook.
Jul 12, 2026
Mandiant reported a cyber-espionage operation that used **infected USB drives** to compromise targeted systems and steal sensitive information. The activity relied on removable media as an initial access vector, allowing attackers to bridge environments where internet connectivity or standard phishing routes may be limited, and then collect data from victim networks. The campaign highlights the continued effectiveness of **USB-borne intrusion techniques** in espionage operations, particularly against organizations that handle confidential material or operate in segmented environments. Mandiant said the attackers used the malicious drives to gain footholds on victim machines and facilitate data theft, underscoring the need for tighter controls on removable media, endpoint monitoring, and restrictions on unauthorized USB device use.
Jul 12, 2026
Government and military-linked networks in the Asia-Pacific region were targeted in espionage campaigns that used compromised USB tools to move malware into **air-gapped environments** and steal sensitive files. Kaspersky reported that a threat cluster dubbed **TetrisPhantom** infected government systems by trojanizing the legitimate `UTetris.exe` application used with hardware-encrypted secure USB drives, then using components including **AcroShell** and **XMKR** to infect hosts, harvest documents, and spread through connected removable media. The malware reportedly communicated with USB devices at the **SCSI** level, injected code into legitimate software, and staged exfiltration so stolen data could leave isolated systems once infected drives were later connected to internet-accessible machines. The activity mirrors earlier reporting on **Tropic Trooper**, which used the **USBferry** malware family to penetrate physically isolated military-related networks in Taiwan and the Philippines by abusing removable media and pivoting through less-secured affiliated organizations such as a military hospital. Trend Micro said USBferry supported reconnaissance, persistence, `rundll32.exe` injection, and covert data theft focused on defense-, ocean-, and ship-related documents. Together with Kaspersky’s broader APT reporting, the incidents show sustained, highly targeted espionage against APAC government and defense entities through weaponized USB ecosystems designed to bypass network isolation.
Aug 15, 2026