USBStealer

Malware & Tools · USBStealer

· MalwareS0136 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. (Citation: ESET Sednit USBStealer 2014) (Citation: Kaspersky Sofacy)

Tactic Coverage

stealth (4)collection (3)exfiltration (2)discovery (2)lateral movement (1)initial access (1)command and control (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (14)

T1020Automated Exfiltration

exfiltration

T1025Data from Removable Media

collection

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1052.001Exfiltration over USB

exfiltration

T1070.004File Deletion

stealth

T1070.006Timestomp

References

https://attack.mitre.org/software/S0136 http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/