Loading story…
Researchers at Shandong University disclosed TrojPix, a covert exfiltration technique that steals data from air-gapped computers by subtly manipulating on-screen pixels so attached video cables emit decodable radio-frequency signals. The method is not an initial access vector; it requires malware to already be running on the target system, but it can operate with user-level privileges, without administrator access or hardware modification, and can either imitate a powered-off display or hide transmissions within normal screen content.
In testing, the researchers said TrojPix achieved up to 8.1 Mbps throughput and a maximum range of 208 meters in separate measurements, making it significantly faster than many previously documented air-gap covert channels and potentially capable of transferring large files. The technique reportedly worked across nine monitor brands and 15 video cables, while recommended mitigations focused on physical and preventive controls such as fiber-optic video links, shielding and TEMPEST-style protections, and stronger measures to prevent malware from reaching air-gapped systems in the first place.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers at Shandong University described TrojPix, a covert channel that exfiltrates data from air-gapped computers by subtly modulating on-screen pixels so attached video cables emit decodable radio signals. They reported that the technique requires malware already running on the target, needs no administrator privileges or hardware modifications, and achieved up to 8.1 Mbps in testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and military-linked networks in the Asia-Pacific region were targeted in espionage campaigns that used compromised USB tools to move malware into **air-gapped environments** and steal sensitive files. Kaspersky reported that a threat cluster dubbed **TetrisPhantom** infected government systems by trojanizing the legitimate `UTetris.exe` application used with hardware-encrypted secure USB drives, then using components including **AcroShell** and **XMKR** to infect hosts, harvest documents, and spread through connected removable media. The malware reportedly communicated with USB devices at the **SCSI** level, injected code into legitimate software, and staged exfiltration so stolen data could leave isolated systems once infected drives were later connected to internet-accessible machines. The activity mirrors earlier reporting on **Tropic Trooper**, which used the **USBferry** malware family to penetrate physically isolated military-related networks in Taiwan and the Philippines by abusing removable media and pivoting through less-secured affiliated organizations such as a military hospital. Trend Micro said USBferry supported reconnaissance, persistence, `rundll32.exe` injection, and covert data theft focused on defense-, ocean-, and ship-related documents. Together with Kaspersky’s broader APT reporting, the incidents show sustained, highly targeted espionage against APAC government and defense entities through weaponized USB ecosystems designed to bypass network isolation.
Aug 15, 2026
ESET reported that the **Sednit** espionage group, also known as **APT28/Fancy Bear**, used malware designed to breach **air-gapped networks** by spreading through removable media. The operation relied on USB devices to move malicious components into isolated environments, allowing the attackers to collect data from systems not directly connected to the internet and then exfiltrate it once the infected media was reconnected to an online machine. The campaign highlighted a deliberate focus on espionage rather than disruption, with tooling tailored to steal documents and system information from sensitive targets. By adapting its tradecraft to bypass physical network isolation, Sednit demonstrated that air gaps alone do not prevent compromise when attackers can exploit trusted workflows involving portable storage and cross-network file transfers.
Jul 12, 2026
Sophos reported that a **PlugX** malware variant is propagating through **USB removable media**, allowing the threat to move between networks and geographic regions without relying solely on internet-based delivery. The worm-like behavior enables infected drives to carry the malware to new systems, where it can execute and continue spreading, extending the reach of a long-observed remote access trojan associated with espionage activity. The campaign highlights the continued risk posed by **air-gapped and intermittently connected environments**, where USB devices remain a practical infection vector. By abusing removable drives for lateral movement and persistence, the operators behind PlugX can bypass some perimeter defenses and transport the malware into organizations through routine device sharing, reinforcing the need for stricter USB controls, endpoint monitoring, and detection of **PlugX**-related artifacts.
Jun 29, 2026