USB Malware Chained with Text Strings to Attack Users

Despite the evolution of several tools and tactics, threat actors still go with the traditional approach to attack victims for malicious purposes. One such threat actor is UNC4990, which uses USB devices to exploit victims. UNC4990 is a financially motivated threat actor and has been conducting campaigns since 2020.

There has been a continuous evolution of this threat actor’s activities. With that being said, the recent tactics involved the use of popular and legitimate websites such as GitHub, GitLab, Ars Technica and Vimeo. 

In addition, the threat actor has been using EMPTYSPACE downloader and QUIETBOARD backdoor. EMPTYSPACE is capable of executing any payload served from the command and control servers, and QUIETBOARD is also delivered using EMPTYSPACE.

USB Malware Chained with Text Strings

Initial Vector

According to the reports shared with Cyber Security News, the threat actor begins the infection chain by delivering the USB drives to the victims by any means of social engineering. Once the victim connects the USB to their device, the USB removable device is shown with a shortcut (.LNK extension) under the vendor name.

When the victims open this malicious LNK shortcut file, it executes a PowerShell script (explorer.ps1), which contains the following command. 

“C:WINDOWSSystem32WindowsPowerShellv1.0powershell.exe -windowstyle has hidden -NoProfile -nologo -ExecutionPolicy ByPass -File explorer.ps1”

The explorer.ps1 is an encoded PowerShell script that checks for specific conditions and fetches the Runtime Broker.exe, which is the EMPTY SPACE downloader. 

Timeline

From the beginning of 2023, the threat actor replaced GitHub with Vimeo, a video-sharing website. A video was added to Vimeo in which the description had the hard-coded payload. However, this video was removed now. Additionally, the Vimeo URL was also embedded inside the explorer.ps1 script.

In mid of December 2023, it was discovered that the threat actor had been using Ars Technica by using an image embedded with the payload. As a backup, the threat actor had also updated the EMPTY SPACE serving URL, which had an additional string.

Furthermore, there have been several versions of EMPTYSPACE loader used by the threat actor, such as the Node JS version, .NET version, and Python version alongside QUIETBOARD.

This Python-based backdoor can execute arbitrary code, cryptocurrency theft, USB drive infection, screenshotting, information gathering, and C2 communications.

Indicators of Compromise

Host-based IOCs

Network-Based IOCs

URL

• hxxps://bobsmith.apiworld[.]cf/license.php
• hxxps://arstechnica[.]com/civis/members/frncbf22.1062014/about/
• hxxps://evinfeoptasw.dedyn[.]io/updater.php
• hxxps://wjecpujpanmwm[.]tk/updater.php?from=USB1
• hxxps://eldi8.github[.]io/src.txt
• hxxps://evh001.gitlab[.]io/src.txt
• hxxps://vimeo[.]com/api/v2/video/804838895.json
• hxxps[://]monumental[.]ga/wp-admin[.]php
• hxxp[://]studiofotografico35mm[.]altervista[.]org/updater[.]php
• hxxp[://]ncnskjhrbefwifjhww[.]tk/updater[.]php
• hxxp[://]geraldonsboutique[.]altervista[.]org/updater[.]php
• hxxps[://]wjecpujpanmwm[.]tk/updater[.]php
• hxxps[://]captcha[.]grouphelp[.]top/updater[.]php
• hxxps[://]captcha[.]tgbot[.]it/updater[.]php
• hxxps://luke.compeyson.eu[.]org/runservice/api/public.php
• hxxps[://]luke[.]compeyson[.]eu[.]org/wp-admin[.]php
• hxxps://luke.compeyson.eu[.]org/runservice/api/public_result.php
• hxxps://eu1.microtunnel[.]it/c0s1ta/index.php
• hxxps[://]davebeerblog[.]eu[.]org/wp-admin[.]php
• hxxps://lucaespo.altervista[.]org/updater.php
• hxxps://lucaesposito.herokuapp[.]com/c0s1ta/index.php
• hxxps://euserv3.herokuapp[.]com/c0s1ta/index.php