Loading story…
Researchers detailed USB Thief, a multi-stage data-stealing trojan built to execute only from a specific removable drive while leaving little or no evidence on the infected Windows system. Instead of relying on common USB infection methods such as Autorun abuse or malicious shortcuts, the malware hijacks legitimate portable applications including Notepad++ and TrueCrypt by inserting a malicious plugin or DLL into their execution chain, then uses several loaders, anti-debugging checks, and anti-antivirus techniques before injecting its payload into svchost.exe.
The malware’s self-protection is designed to make analysis and reuse difficult: it uses AES-128 encryption bound to the USB device ID and disk properties, and derives filenames from SHA-512 hashes of file contents and creation times so each sample is effectively tied to one device. Once active, it steals files, registry data, drive file listings, and system information gathered with WinAudit, storing the collected data back on the removable device. Researchers said the threat did not appear widespread, but warned it could be effective in targeted intrusions, particularly against isolated or air-gapped environments.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
ESET reported a rare multi-stage data-stealing trojan dubbed USB Thief that was found in the wild on USB devices. The analysis described its device-specific self-protection, portable-application hijacking, anti-analysis checks, and data theft from compromised systems back to the removable drive.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two Windows malware strains that spread through removable media and target cryptocurrency users. Microsoft-tracked `Trojan:Win32/CryptoBandits.A` uses malicious `.LNK` shortcut files on USB drives to hide legitimate documents, replace them with look-alike shortcuts, and copy itself to newly attached media. Once launched, it steals seed phrases and private keys, captures screenshots, replaces copied wallet addresses with attacker-controlled values, and uses a bundled Tor client over `localhost:9050` for command-and-control; an `EVAL` backdoor command also enables arbitrary code execution on infected hosts. Separate reverse-engineering of a Phorpiex sample showed similar USB and network-drive worm behavior alongside downloader and crypto-theft functions. The malware copies itself to writable locations for persistence, creates a `Run` key named **Windows Settings**, deletes its `Zone.Identifier` alternate data stream, adds Windows Defender exclusions, and disables Windows Update- and Defender-related protections. It also spreads as `VolDrvConfig.exe`, performs clipboard hijacking to redirect cryptocurrency payments, and downloads additional payloads, including cryptominers, from hard-coded infrastructure such as `185.215.113.66` into the temp directory under randomized filenames.
Jul 7, 2026
Mandiant reported a cyber-espionage operation that used **infected USB drives** to compromise targeted systems and steal sensitive information. The activity relied on removable media as an initial access vector, allowing attackers to bridge environments where internet connectivity or standard phishing routes may be limited, and then collect data from victim networks. The campaign highlights the continued effectiveness of **USB-borne intrusion techniques** in espionage operations, particularly against organizations that handle confidential material or operate in segmented environments. Mandiant said the attackers used the malicious drives to gain footholds on victim machines and facilitate data theft, underscoring the need for tighter controls on removable media, endpoint monitoring, and restrictions on unauthorized USB device use.
Jul 12, 2026
Government and military-linked networks in the Asia-Pacific region were targeted in espionage campaigns that used compromised USB tools to move malware into **air-gapped environments** and steal sensitive files. Kaspersky reported that a threat cluster dubbed **TetrisPhantom** infected government systems by trojanizing the legitimate `UTetris.exe` application used with hardware-encrypted secure USB drives, then using components including **AcroShell** and **XMKR** to infect hosts, harvest documents, and spread through connected removable media. The malware reportedly communicated with USB devices at the **SCSI** level, injected code into legitimate software, and staged exfiltration so stolen data could leave isolated systems once infected drives were later connected to internet-accessible machines. The activity mirrors earlier reporting on **Tropic Trooper**, which used the **USBferry** malware family to penetrate physically isolated military-related networks in Taiwan and the Philippines by abusing removable media and pivoting through less-secured affiliated organizations such as a military hospital. Trend Micro said USBferry supported reconnaissance, persistence, `rundll32.exe` injection, and covert data theft focused on defense-, ocean-, and ship-related documents. Together with Kaspersky’s broader APT reporting, the incidents show sustained, highly targeted espionage against APAC government and defense entities through weaponized USB ecosystems designed to bypass network isolation.
Aug 15, 2026