FBI: Cybercriminals are mailing out USB drives that will install ransomware

A cybercrime group has been mailing out USB thumb-drives in the hopes that recipients will plug them into their PCs and thus install ransomware on their networks, according to the FBI. 

The USB drives contained so-called ‘BadUSB’ attacks and were sent in postal mail through the United States Postal Service and United Parcel Service. One type contained a message impersonating the US Department of Health and Human Services and claimed to be a COVID-19 warning. Other malicious USBs were sent in the post with a gift card claiming to be from Amazon. 

BadUSB exploits the USB standard’s versatility and allow an attacker to reprogram a USB drive to, for example, emulate a keyboard to create keystrokes and commands on a computer, install malware prior to the operating system booting, or to spoof a network card and redirect traffic. 

While BadUSB attacks aren’t common, cybercriminals in 2020 posted BadUSB drives to targets in the post with a message claiming to be from BestBuy which urged recipients to insert a malicious USB thumb drive into a computer in order view products that could be redeemed from a supposed gift card. That attack was attributed to the FIN7 group which is also believed to be behind this attack.

According to The Record, the FBI warned that the new BadUSB attackers were shipped on LilyGO-branded devices. The mail was delivered in packages to organizations in the transport and insurance sectors from August while defense industry targets have received the packages since November. 

The USB drives were configured to register as a keyboard device after being plugged in and then inject keystrokes into the target PC to install malware. Numerous attack tools were installed that allowed for exploitation of PCs, lateral movement across a network, and installation of additional malware.   

The tools were used to deploy multiple ransomware strains, including BlackBatter and REvil. BlackMatter is believed to be a rebrand of DarkSide ransomware group, which appeared to close its business after attacking US fuel distributor Colonial Pipeline in May which prompted discussions between the Biden Administration and the Kremlin over attacks on critical infrastructure.