FBI Warns FIN7 Campaign Delivers Ransomware via BadUSB

An FBI warning says the FIN7 cybercrime group has sent packages containing malicious USB drives to US companies in an effort to spread ransomware.

Dark Reading Staff, Dark Reading

January 10, 2022

1 Min Read
Dark Reading logo in a gray background | Dark Reading

The FBI has warned of a FIN7 cybercrime campaign in which attackers mail USB thumb drives to US organizations with the goal of delivering ransomware into their environments.

In an alert sent late last week, the FBI said it has received reports of several packages containing malicious USB devices that were sent to US companies in the transportation, insurance, and defense industries. The activity has been ongoing since August 2021, the FBI said, and packages were sent via the United States Postal Service and United Parcel Service.

There are two versions of packages sent: One is disguised to appear as though it's from the US Department of Health and Human Services; these parcels often contain messages about COVID-19 guidelines in addition to the USB. The second type is designed to imitate Amazon; these come in a decorated gift box with a thank-you message, fake gift card, and the malicious USB.

According to the FBI, recipients who plug these USB drives into their devices would become the victims of a "BadUSB" attack in which the USB would register itself as a keyboard and send preconfigured keystrokes and commands to the machine. These would run PowerShell commands that installed malware and became a backdoor for future access.

FIN7 has reportedly used several tools — including Metasploit, Cobalt Strike, Carbanak, and PowerShell scripts — to deploy ransomware, such as BlackMatter and REvil, on target networks, reported The Record, citing the FBI alert.

Read more details here.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights