FIN7 group continues to target US companies with BadUSB devices

The Federal Bureau of Investigation (FBI) warns US companies that the FIN7 cybercriminals group is targeting the US defense industry with BadUSB devices.

The US Federal Bureau of Investigation issued a flash alert to warn that the financially motivated group FIN7 has sent malicious USB devices, BadUSB devices, to US companies over the past few months to infect their systems with the malware.

The gang is using weaponized USB devices with the LilyGO logo, which are sent to the victims via United States Postal Service and United Parcel Service.

FIN7 using this technique to target businesses in the transportation and insurance industries since August 2021, while it started targeting defense firms since November 2021.

The operators impersonate Amazon and the US Department of Health & Human Services  (HHS) to trick the victims into opening the packages and plugging the BadUSB devices into their systems.

According to the alert, threat actors employed packages containing letters about COVID-19 guidelines or counterfeit gift cards and forged thank you notes.

“Since August 2021, the FBI has received reports of several packages containing these USB devices, sent to US businesses in the transportation, insurance, and defense industries,” reads the flash alert issued by the FBI that was visioned by TheRecord. “The packages were sent using the United States Postal Service and United Parcel Service,” continues the alert. “There are two variations of packages—those imitating HHS [US Department of Health and Human Services ] are often accompanied by letters referencing COVID-19 guidelines enclosed with a USB; and those imitating Amazon arrived in a decorative gift box containing a fraudulent thank you letter, counterfeit gift card, and a USB.”

Upon plugging the USB thumb drives into a computer, a BadUSB attack is triggered and the devices act as a keyboard (HID Emulator USB) to send commands to the system.

In the attacks analyzed by the FBI, the attack would run PowerShell commands to download and install malicious payloads, including BlackMatter and REvil ransomware. The FIN7 group used a broad range of tools and malware such as Metasploit, Cobalt Strike, PowerShell scripts, Carbanak, GRIFFON, DICELOADER, TIRION.

In some of the attacks investigated by the FBI, the cybercrime group obtained administrative access and moved laterally within the target network.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, BadUSB)

---