China’s Mustang Panda APT Takes Espionage Cross-Border: USB Drives as Spyware Delivery Tools

Espionage Malware Spreads Through Infected USB Drives

The Incident and the Chinese-State-Sponsored APT

Researchers from Check Point Research have discovered a backdoor malware called WispRider that spreads through infected USB drives. This incident occurred at a European healthcare institution when an employee, who had participated in a conference in Asia, brought back an infected USB drive. The malware then spread to the hospital’s computer systems, highlighting the global reach of the Chinese-state-sponsored APT known as Camaro Dragon or Mustang Panda. This APT, previously focused on Southeast Asia, has now extended its cyber espionage activities worldwide.

The Role of USB Drives in Spreading Malware

The incident underscores the alarming role USB drives play in quickly spreading malware, even to air-gapped systems. Malicious programs like WispRider have the ability to self-propagate through USB drives, making them potent carriers of infection. This capability allows malware to extend beyond their intended targets, posing significant risks to organizations and individuals.

WispRider: An Evolving Malware Payload

WispRider is the main payload of the campaign discovered by Check Point researchers. It is a backdoor that has evolved over time, adding additional features and capabilities. The malware propagates through USB drives using a launcher called HopperTick and includes a bypass for SmadAV, a popular antivirus solution in Southeast Asia. WispRider also performs DLL-side-loading using security software components and components of major gaming companies like Electronic Arts and Riot Games. Check Point researchers have notified these companies of their components being used in the malware.

Attribution and Related Malware

WispRider and HopperTick align with other tools used by Mustang Panda, such as TinyNote and HorseShell, indicating their attribution to the Chinese APT. Mustang Panda has been known to launch cyberespionage campaigns globally, targeting various organizations, including the Russian military.

Infection Flow and Behavior of WispRider

When a benign USB thumb drive is inserted into an infected computer, WispRider manipulates the drive’s files and creates hidden folders. It copies a Delphi loader with the name and icon of the original drive into the thumb drive. The infection relies on social engineering, as victims are left with only the executable file, which they are likely to click to reveal their files. WispRider acts as both an infector and backdoor, running from infected machines or infecting machines that have not been compromised yet.

Mitigating USB-Borne Cyber Threats

USB-propagated infections have become a popular attack vector for APTs and cybercriminal groups due to their rapid spread and ability to bypass heavily secured networks. Organizations must take measures to protect themselves against USB drive-based attacks. Check Point researchers recommend the following:

Awareness and Caution

– Raise awareness among employees about the potential dangers of using USB drives from unknown or untrusted sources.
– Encourage cautious behavior and discourage the use of unfamiliar drives on corporate devices.

Establish Guidelines and Limit Usage

– Establish strict guidelines regarding the use of USB drives on corporate devices connected to the network.
– Consider limiting or prohibiting the use of USB drives unless obtained from trusted sources.

Explore Secure Alternatives

– Seek secure alternatives to USB drives, such as cloud storage or encrypted file-sharing platforms.
– Reduce reliance on physical USB drives to mitigate associated risks.

Keep Security Measures Up to Date

– Update antivirus software and other security solutions across all devices regularly.
– Periodically scan USB drives for potential infections to protect corporate networks.

Editorial: The Ongoing Challenge of USB-Borne Cyber Threats

The incident at the European healthcare institution serves as a stark reminder of the ongoing challenge posed by USB-borne cyber threats. Despite the advancements in technology and increased awareness, the use of infected USB drives continues to be an effective and prevalent method for spreading malware.

USB drive-based attacks are appealing to threat actors due to their simplicity and the unsuspecting nature of users. By exploiting social engineering techniques, malware can easily infect systems when users unknowingly execute malicious files. Furthermore, the ability of malware to self-propagate through USB drives is a cause for concern, as it allows infections to spread rapidly across networks, even to air-gapped systems.

To address this issue, organizations must prioritize cybersecurity awareness and education among employees. It is crucial to instill a cautious and skeptical mindset when handling USB drives, especially those obtained from unknown or untrusted sources. Establishing clear guidelines regarding the use of USB drives on corporate devices and considering alternatives like cloud storage can significantly reduce the risk of USB-borne cyber threats.

Additionally, maintaining up-to-date security measures, including antivirus software and regular scanning of USB drives, should be an essential part of any organization’s cybersecurity strategy. As cyber threats continue to evolve, it is imperative to stay vigilant and adapt security practices accordingly.

Advice for Individuals: Protecting Yourself Against USB-Borne Malware

USB-borne malware threats are not limited to organizations but also pose risks to individuals. To protect yourself and your personal devices from USB-based attacks, consider the following recommendations:

Exercise Caution

– Be skeptical of USB drives from unknown or untrusted sources.
– Avoid using unfamiliar drives on your devices, especially if they are unrelated to your specific needs.

Consider Secure Alternatives

– Explore alternative methods for transferring and storing files, such as cloud storage or encrypted file-sharing platforms.
– Reduce dependency on physical USB drives to minimize the risk of infection.

Keep Security Software Updated

– Install and regularly update antivirus software and other security solutions on your devices.
– Periodically scan USB drives for potential infections using reliable security software.

By adopting these measures, individuals can significantly reduce the likelihood of falling victim to USB-borne malware attacks. It is important to remain cautious and proactive in ensuring the security of personal devices and sensitive information.