This malware hides on USB drives, waiting to strike Windows machines

Date:
Mon, 30 Jan 2023 13:07:43 +0000

Description:
PlugX malware is looking out for any USB device it can infect and hide your most important files.

FULL STORY ======================================================================

Palo Alto Networks Unit 42 team has uncovered a series of tools and malware samples in a recent Black Basta breach, with one particularly nasty train gaining particular attention.

The campaign uses years-old PlugX malware to infect removable USB drives , which can go on to affect any Windows host they are connected to.

Apparently existing for more than a decade, the campaign was initially credited to Chinese hacker groups however it has supported an evolving set of capabilities throughout the years, rendering it very difficult to attribute threats to any given group or individual. PlugX USB malware

In this latest iteration, researchers found that it can go almost undetected even on the latest version of Windows, to the point where malicious files can only be viewed on a Unix-like OS or by mounting the USB device in a forensic tool.

It hides files by using a certain Unicode character, stopping Windows
Explorer and the command shell from showing users the USB directory
structure, effectively hiding files that it has copied from its host. It has been found to target primarily Adobe PDF and Microsoft Word files. Read more

These are the b est secure drives of 2023

Russia hacker group hijacks USB attacks by other criminals

Hardware drivers approved by Microsoft used in ransomware attacksA

The report details that the malware continuously monitors for new USB removable devices, and victims unknowingly continue to spread the PlugX malware thanks to its novel trickery.

Full details of the findings, and the process that the malware is said to follow, can be found on Palo Alto Networks website . It also promises to have shared its findings with fellow Cyber Threat Alliance (CTA) members, which includes Avast, McAfee, and Sophos.

Its own products are designed to protect users from such attacks, but it
urges them to get in touch if they believe they have been infected. Moreover, computer users are urged to take a cautious approach to suspicious websites, emails, and other activities that could be the source of any cyberattacks. Protect your computer with our roundup of the best endpoint protection software and best firewalls



======================================================================
Link to news story: https://www.techradar.com/news/this-malware-hides-on-usb-drives-waiting-to-str ike-windows-machines


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)