TetrisPhantom: targeted attacks using secure USB

Wednesday 4 October 11:20 - 11:50, Green room 

Noushin Shabab (Kaspersky)

In early 2023 we discovered an ongoing attack targeting government entities in the APAC region by compromising a specific type of a secure USB drive, which provides hardware encryption. Such secure USB drives are used by the government organizations of the country to securely store and transfer data physically between computer systems. The USB drive contains a protected partition which can only be accessed via custom software bundled on an unencrypted part of the USB and a passphrase known to the user.

The malware modules used in these attacks are used to execute commands and collect files and information from compromised machines and pass them on to further machines using the same or other secure USB drives as a carrier. They are capable of executing other malicious files on the infected systems too.

The attack comprises sophisticated tools and techniques such as:

• virtualization-based software obfuscation for malware components
• low-level communication with the USB drive using direct SCSI commands
• self replication through connected secure USB drives to propagate to other air-gapped systems
• injection of code into a legitimate access management program on the USB drive, which acts as a loader for the malware on a new machine.

The attacks investigated in this research were extremely targeted and had a quite limited number of victims. Our investigation revealed a high level of sophistication in the malicious tools used in the deployment of the attacks. We believe these attacks have been carried out by a highly skilled and resourceful threat actor interested in espionage activities in sensitive and protected government networks, and therefore it’s very important to build a deep understanding of the TTPs of this threat actor and to watch out for future attacks.

In this talk we will look at the various aspects of this investigation with a particular focus on the technical analysis of the malicious files involved in the attacks.

• Download paper for this talk

Noushin Shabab Noushin Shabab joined Kaspersky in 2016 as a senior security researcher in the Global Research & Analysis Team (GReAT). Her research focuses on the investigation of advanced cybercriminal activities and targeted attacks with a particular focus on local threats in the Asia Pacific region. Prior to joining Kaspersky, Noushin worked as a senior malware analyst and security software developer focusing on rootkit analysis and detection techniques as well as APT attack investigations. Noushin is very active in the cybersecurity community where she regularly presents at various security conferences and events and also delivers technical workshops. Some of her previous conference presentations include BlackHat Asia, AusCERT, Security Analyst Summit, Ruxcon, Kawaiicon, MRE and various BSides events. She is an industry supervisor for Federation University and has been a guest lecturer at RMIT University, Melbourne Institute of Technology and the University of Guelph, Canada. She is also a member of the Australian Women in Security Network (AWSN), which aims to connect, support, collaborate and inspire women in the Australian cybersecurity industry. @NoushinShbb

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers