07/18/2023
From the sans.org mailing list:
Incidence of USB Drives as Initial Attack Vector on the Rise
(July 11, 13, & 17, 2023)
According to Mandiant, the number of attacks using USB drives as the initial vector of intrusion has increased significantly over the first six months of 2023. In a blog post, Mandiant describes two attack campaigns that used USB drives as the initial vector of attack: SOGU and SNOWYDRIVE. SOGU has been used in attacks targeting both public and private organizations across sectors; SNOWYDRIVE has been used in attacks against the oil and gas industries in Asia.
Editor's Note
[Neely]
Time to remind folks about being wary of USB drives bearing gifts, because, yes, it's still a thing. Consider media kiosks for transferring any information from "foreign" USB (or other media) to trusted media. Make sure you're monitoring USB use and that your EDR is not ignoring malware using them as a delivery mechanism.
[Dukes]
With today’s connectivity, cloud access, and collaboration platforms, the need for USB drives has plummeted. But perhaps in certain regions of the world, they forego these more modern means and continue to use USB drives. The bottom line: miscreants will use whatever means available to compromise hosts.
[Frost]
We had been asked to do pe*******on testing work using USB drops recently. I guess this is something that is happening more frequently again. Is it because people are moving around and returning to work environments?
https://www.bleepingcomputer.com/news/security/usb-drive-malware-attacks-spiking-again-in-first-half-of-2023/
What's old is new again, with researchers seeing a threefold increase in malware distributed through USB drives in the first half of 2023
