Written by
Liam Tung, Contributor
Liam Tung
Contributor
Liam Tung is an Australian business technology journalist living a few too many Swedish miles north of Stockholm for his liking. He gained a bachelors degree in economics and arts (cultural studies) at Sydney’s Macquarie University, but hacked (without Norse or malicious code for that matter) his way into a career as an enterprise tech, security and telecommunications journalist with ZDNet Australia.
Full Bio
on January 10, 2022
| Topic: Security
Cybercrime college: Dark web courses teach wannabe hackers how to build botnets
Watch Now
A cybercrime group has been mailing out USB thumb drives in the hope that recipients will plug them into their PCs and install ransomware on their networks, according to the FBI.
The USB drives contain so-called ‘BadUSB’ attacks. They were sent in the mail through the United States Postal Service and United Parcel Service. One type contained a message impersonating the US Department of Health and Human Services and claimed to be a COVID-19 warning. Other malicious USBs were sent in the post with a gift card claiming to be from Amazon.
BadUSB exploits the USB standard’s versatility and allows an attacker to reprogram a USB drive to, for example, emulate a keyboard to create keystrokes and commands on a computer, install malware prior to the operating system booting, or to spoof a network card and redirect traffic.
SEE: Your cybersecurity training needs improvement because hacking attacks are only getting worse
While BadUSB attacks aren’t common, cyber criminals in 2020 posted BadUSB drives to targets in the post with a message claiming to be from BestBuy that urged recipients to insert a malicious USB thumb drive into a computer in order view products that could be redeemed from a supposed gift card. That attack was attributed to the FIN7 group, which is also believed to be behind this attack.
According to The Record, the FBI warned that the new BadUSB attacks were shipped on LILYGO-branded devices. The mail was delivered in packages to organizations in the transport and insurance sectors from August, while defense industry targets have received the packages since November.
The USB drives were configured to register as a keyboard device after being plugged in. They then injected keystrokes into the target PC to install malware. Numerous attack tools were installed that allowed for exploitation of PCs, lateral movement across a network, and installation of additional malware.
The tools were used to deploy multiple ransomware strains, including BlackBatter and REvil. BlackMatter is believed to be a rebrand of the DarkSide ransomware group, which appeared to close its business after attacking US fuel distributor Colonial Pipeline in May. This attack prompted discussions between the Biden Administration and the Kremlin over attacks on critical infrastructure.
Security
NoReboot attack fakes iOS phone shutdown to spy on you
JFrog researchers find JNDI vulnerability in H2 database consoles similar to Log4Shell
Cybersecurity training isn’t working. And hacking attacks are getting worse
The 5 best VPN services in 2022
The biggest data breaches, hacks of 2021
Security TV
|
Data Management
|
CXO
|
Data Centers