[ad_1]
Picture: Brina Blum
The Federal Bureau of Investigation (FBI) warned US firms in a lately up to date flash alert that the financially motivated FIN7 cybercriminal group focused the US protection business with packages containing malicious USB gadgets to deploy ransomware.
The attackers mailed packages containing ‘BadUSB’ or ‘Dangerous Beetle USB’ gadgets with the LilyGO brand, generally out there on the market on the Web.
They used the US Postal Service (USPS) and United Parcel Service (UPS) to e mail the malicious packages to companies within the transportation and insurance coverage industries since August 2021 and protection corporations beginning with November 2021.
BlackMatter or REvil ransomware deployed on breached networks
FIN7 operators impersonated Amazon and the US Division of Well being & Human Providers (HHS) to trick the targets into opening the packages and connecting the USB drives to their programs.
Since August, experiences acquired by the FBI say that these malicious packages additionally include letters about COVID-19 pointers or counterfeit reward playing cards and solid thanks notes, relying on the impersonated entity.
After the targets plug the USB drive into their computer systems, it robotically registers as a Human Interface System (HID) Keyboard (permitting it to function even with detachable storage gadgets toggled off).
It then begins injecting keystrokes to put in malware payloads on the compromised programs.
FIN7’s finish objective in such assaults is to entry the victims’ networks and deploy ransomware (together with BlackMatter and REvil) inside a compromised community utilizing varied instruments, together with Metasploit, Cobalt Strike, Carbanak malware, the Griffon backdoor, and PowerShell scripts.
Malware pushed utilizing teddy bears
These assaults comply with one other collection of incidents the FBI warned about two years in the past when FIN7 operators impersonated Finest Purchase and mailed related packages with malicious flash drives through USPS to motels, eating places, and retail companies.
Studies of such attackers began surfacing again in February 2020. A number of the targets additionally reported that the hackers emailed or referred to as to strain them into connecting the drives to their programs.
Starting with not less than Might 2020, malicious packages despatched by FIN7 additionally included gadgets similar to teddy bears designed to trick the targets’ into reducing their guard.
Assaults like these tried by FIN7 are generally known as HID or USB drive-by assaults, they usually can solely achieve success if the victims are keen to or tricked into plugging unknown USB gadgets into their workstations.
Firms can defend towards such assaults by permitting their staff to attach solely USB gadgets primarily based on their {hardware} ID or in the event that they’re vetted by their safety group.
[ad_2]
