Russian Hackers May Have Spread This Malware Via Removable Drives

A malware-laden storage drive may have helped Russia spy on military activities in Ukraine. 

Cybersecurity vendor Symantec recently uncovered the attack, including evidence that the Windows-based malware arrived through an “infected removable drive.” It found that targeted PCs created a registry key, which indicates the machine accessed a malicious file from the location “D:files.lnk.” The D drive is often assigned to removable drives. 

After the file was accessed, the targeted PC then ran Windows Explorer and the legitimate Microsoft utility Mshta.exe to deliver what appeared to be a malicious VBScript payload. The apparent goal was to deliver a final payload—malware known as “GammaSteel”—which can identify and steal numerous files by sending them to a hacker-controlled server. 

Symantec has attributed the attack to a Russian hacking group called Shuckworm or Gamaredon, which has been active since at least 2013. The Ukrainian government alleges that the hacking group works for Russia’s Federal Security Service, or what was once the Soviet Union’s spy agency, the KGB. 

In this case, the attack targeted a “military mission in Ukraine,” with the malware infection initially occurring in February and continuing into March. “GammaSteel was deployed following a complex, multi-staged attack chain, with frequent use of obfuscation,” Symantec says. “The process was most likely designed to minimize the risk of detection.”

The incident highlights how hackers can exploit USB drives to spread malware, although such attacks are rare and usually go after high-profile targets, including companies or governments. Last year, antivirus provider ESET discovered a separate hacking group using malware that can infect an internet-connected computer and then copy itself to a USB drive.

About Michael Kan

Senior Reporter

I’ve been working as a journalist for over 15 years—I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017.

Read Michael’s full bio

Read the latest from Michael Kan