Palo Alto Networks’ Unit 42 team has uncovered a series of tools and malware samples in a recent Black Basta breach, with one particularly nasty train gaining particular attention.
The campaign uses years-old PlugX malware to infect removable USB drives, which can go on to affect any Windows host they are connected to.
Apparently existing for more than a decade, the campaign was initially credited to Chinese hacker groups however it has supported an “evolving set of capabilities throughout the years”, rendering it very difficult to attribute threats to any given group or individual.
PlugX USB malware
In this latest iteration, researchers found that it can go almost undetected even on the latest version of Windows, to the point where malicious files “can only be viewed on a Unix-like OS or by mounting the USB device in a forensic tool.”
It hides files by using a certain Unicode character, stopping Windows Explorer and the command shell from showing users the USB directory structure, effectively hiding files that it has copied from its host. It has been found to target primarily Adobe PDF and Microsoft Word files.
The report details that the malware continuously monitors for new USB removable devices, and victims unknowingly continue to spread the PlugX malware thanks to its “novel” trickery.
Full details of the findings, and the process that the malware is said to follow, can be found on Palo Alto Networks’ website. It also promises to have shared its findings with fellow Cyber Threat Alliance (CTA) members, which includes Avast, McAfee, and Sophos.
Its own products are designed to protect users from such attacks, but it urges them to get in touch if they believe they have been infected. Moreover, computer users are urged to take a cautious approach to suspicious websites, emails, and other activities that could be the source of any cyberattacks.
- Protect your computer with our roundup of the best endpoint protection software and best firewalls
