USBStealer

MITRE ATT&CK: S0136 View on attack.mitre.org

Aliases: USB Stealer, Win32/USBStealer, USBStealer

First seen
2005-01-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:43:19

Targeted industries: government-and-public-sector defense-and-aerospace

Targeted regions: country_code:ru country_code:ua country_code:us

Context

USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL.

Detection coverage

  • 1 YARA rules
  • 104 Sigma rules

Malware & tools used

  • File and Directory Discovery (attack-pattern)
  • Exfiltration over USB (attack-pattern)
  • Timestomp (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Automated Collection (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Automated Exfiltration (attack-pattern)
  • Communication Through Removable Media (attack-pattern)
  • Replication Through Removable Media (attack-pattern)
  • File Deletion (attack-pattern)
  • Peripheral Device Discovery (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Data from Removable Media (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Apt_Badmagic_Commonmagic_Usbstealer (yara-rule)

Reports & references

  • Kaspersky — 72924 (report)
  • ESET — Sednit Espionage Group Attacking Air Gapped Networks (report)
  • MITRE ATT&CK — S0136 (report)

External references