MITRE ATT&CKsoftware (malware)
S0452 USBferry
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2020-05-20
Description
USBferry is an information stealing malware and has been used by Tropic Trooper in targeted attacks against Taiwanese and Philippine air-gapped military environments. USBferry shares an overlapping codebase with YAHOYAH, though it has several features which makes it a distinct piece of malware.
Related
Uses · MITRE ATT&CK (11)
- T1059.003 Windows Command Shell sub-technique
- T1087.001 Local Account sub-technique
- T1218.011 Rundll32 sub-technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1018 Remote System Discovery technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1091 Replication Through Removable Media technique
- T1120 Peripheral Device Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0081 Tropic Trooper group
References
- https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf TrendMicro Tropic Trooper May 2020