MITRE ATT&CKsoftware (malware)
S0136 USBStealer
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- USB Stealer, Win32/USBStealer
- Version
- 1.3
- Created
- 2017-05-31
Description
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL.
Related
Uses · MITRE ATT&CK (14)
- T1027.013 Encrypted/Encoded File sub-technique
- T1074.001 Local Data Staging sub-technique
- T1052.001 Exfiltration over USB sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1020 Automated Exfiltration technique
- T1025 Data from Removable Media technique
- T1083 File and Directory Discovery technique
- T1091 Replication Through Removable Media technique
- T1092 Communication Through Removable Media technique
- T1119 Automated Collection technique
- T1120 Peripheral Device Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0007 APT28 group