This malware hides on USB drives, waiting to strike Windows machines

user inserting a USB flash drive into a laptop
(Image credit: Rostec)

Palo Alto Networks’ Unit 42 team has uncovered a series of tools and malware samples in a recent Black Basta breach, with one particularly nasty train gaining particular attention.

The campaign uses years-old PlugX malware to infect removable USB drives, which can go on to affect any Windows host they are connected to.

Apparently existing for more than a decade, the campaign was initially credited to Chinese hacker groups however it has supported an “evolving set of capabilities throughout the years”, rendering it very difficult to attribute threats to any given group or individual.

Protecting your business from the biggest threats online

<a href="" data-link-merchant=""">Protecting your business from the biggest threats online Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (<a href="" data-link-merchant=""" data-link-merchant=""" target="_self">What does this mean?) 

PlugX USB malware

In this latest iteration, researchers found that it can go almost undetected even on the latest version of Windows, to the point where malicious files “can only be viewed on a Unix-like OS or by mounting the USB device in a forensic tool.”

It hides files by using a certain Unicode character, stopping Windows Explorer and the command shell from showing users the USB directory structure, effectively hiding files that it has copied from its host. It has been found to target primarily Adobe PDF and Microsoft Word files.

The report details that the malware continuously monitors for new USB removable devices, and victims unknowingly continue to spread the PlugX malware thanks to its “novel” trickery.

Full details of the findings, and the process that the malware is said to follow, can be found on Palo Alto Networks’ website. It also promises to have shared its findings with fellow Cyber Threat Alliance (CTA) members, which includes Avast, McAfee, and Sophos.

Its own products are designed to protect users from such attacks, but it urges them to get in touch if they believe they have been infected. Moreover, computer users are urged to take a cautious approach to suspicious websites, emails, and other activities that could be the source of any cyberattacks.

Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!