Loading story…
Japan’s Ground Self-Defense Force reportedly connected counterfeit USB flash drives carrying malware to computers on sensitive military networks, exposing more than 50 systems, including machines handling classified troop movement information. Leaked internal documents cited by Nikkei say the compromised drives entered use during earthquake relief operations in central Japan in March 2024, bypassed normal procurement controls, and remained in circulation until the malware was discovered in February 2025 after abnormal system behavior at Middle Army headquarters in Itami.
Investigators reportedly found the same malicious code on six of eight tested drives, and the malware was linked in internal reporting to a strain previously associated by a U.S. cybersecurity firm with a China-backed hacking group. Japan’s Defense Ministry publicly confirmed only that a USB drive obtained by Middle Army headquarters contained malware, while saying the code was an older self-replicating type that did not exfiltrate data or communicate externally. The incident has raised wider supply-chain concerns because similar counterfeit infected drives were reportedly sold online and had also reached factories and research institutions across Japan.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent investigation found the same malicious code on six of eight tested drives and determined that the infected media had been connected to more than 50 computers, including systems handling classified troop movement information. The malware was described as an older self-replicating type, and leaked documents said it matched a strain previously linked by a U.S. cybersecurity firm to a China-backed hacking group.
Nikkei reported that the compromise had lasted from March 2024 until its discovery in February 2025 and that the JGSDF kept the matter internal rather than broadly disclosing it. The report also said similarly infected counterfeit USB drives were being sold online and had spread to factories and research institutions across Japan.
In February 2025, abnormal system performance at JGSDF Middle Army headquarters in Itami led to the discovery of malware on a USB drive acquired by the force. The GSDF publicly confirmed only that a malware-infected USB drive was found at the headquarters that month.
Leaked internal documents indicate counterfeit USB flash drives were brought into use by Japan's Ground Self-Defense Force during earthquake disaster relief operations in central Japan, bypassing normal procurement controls. These drives were later reported to have been manufactured in China and infected with malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and military-linked networks in the Asia-Pacific region were targeted in espionage campaigns that used compromised USB tools to move malware into **air-gapped environments** and steal sensitive files. Kaspersky reported that a threat cluster dubbed **TetrisPhantom** infected government systems by trojanizing the legitimate `UTetris.exe` application used with hardware-encrypted secure USB drives, then using components including **AcroShell** and **XMKR** to infect hosts, harvest documents, and spread through connected removable media. The malware reportedly communicated with USB devices at the **SCSI** level, injected code into legitimate software, and staged exfiltration so stolen data could leave isolated systems once infected drives were later connected to internet-accessible machines. The activity mirrors earlier reporting on **Tropic Trooper**, which used the **USBferry** malware family to penetrate physically isolated military-related networks in Taiwan and the Philippines by abusing removable media and pivoting through less-secured affiliated organizations such as a military hospital. Trend Micro said USBferry supported reconnaissance, persistence, `rundll32.exe` injection, and covert data theft focused on defense-, ocean-, and ship-related documents. Together with Kaspersky’s broader APT reporting, the incidents show sustained, highly targeted espionage against APAC government and defense entities through weaponized USB ecosystems designed to bypass network isolation.
Aug 15, 2026
Mandiant reported a cyber-espionage operation that used **infected USB drives** to compromise targeted systems and steal sensitive information. The activity relied on removable media as an initial access vector, allowing attackers to bridge environments where internet connectivity or standard phishing routes may be limited, and then collect data from victim networks. The campaign highlights the continued effectiveness of **USB-borne intrusion techniques** in espionage operations, particularly against organizations that handle confidential material or operate in segmented environments. Mandiant said the attackers used the malicious drives to gain footholds on victim machines and facilitate data theft, underscoring the need for tighter controls on removable media, endpoint monitoring, and restrictions on unauthorized USB device use.
Jul 12, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026