further commands to the malware so they can change the plan of attack as they go everything in orange here refers to that kind of attack let's look at some real world examples thanks to eset's report we have quite a smaller board to choose from and can we just take a second to appreciate the weird names of these hacks sure there are some boring names like usb steeler and usb thief NUMBER_TOKEN out of NUMBER_TOKEN for creativity but there's also brutal kangaroo easy cheese and fanny which i think must have a different meaning in america where they came up with this name and no i'm not going to risk demonetization by explaining that one anyway let's look at plug x boring name yes however the name of the group behind it more than makes up for it they're called mustang panda which is a chinese-based group the purpose of the plug-x hack was to perform espionage against unknown entities unfortunately as with many hacks the whole story isn't public so we don't know who the victim was here or even what kind of facility was being attacked the initial compromise targeted a connected part of the unknown entities network through malware-laden spearfishing emails once the plug-x malware had been installed it's monitored for the arrival of usb drives and weaponized them their method of weaponization wasn't even rocket science at all but it is sneaky on the usb drive the malware created a hidden folder called URL_TOKEN and put their malware inside of it then it made these shortcut files which pointed to the malware in the hidden folder double-click the shortcuts and you open the malware now if you've ever made a shortcut on windows you'll know you can change the icon to pretty much anything including a folder icon the only thing that gives it away is the shortcut overlay in the bottom left which to be fair is easily missed the idea was an unwitting victim would then plug this usb drive into the air gaps network then their curiosity would get the better of them they'd wonder what the hell are these strange folders then they'd open one of the shortcuts triggering the malware the malware would scan the system for certain documents encrypt them and copy them back to the usb drive until it was plugged back into the connected system from which they would then be exfiltrated over the interwebs to the hackers the plug exact is an example of non-automated execution in that the malware on the usb stick has to be manually run by an unwitting victim though some usb hacks fall into the automated category these hacks don't require any user interaction at all just plugging in a usb drive is enough to pone the air gap system these are infinitely more advanced than just hoping someone double clicks on a disguised shortcut the most notorious example of this comes in the form of stuxnet only the most famous hack of all time stuxnet was a joint us and israeli mission to hack into iran's natanz nuclear facility which resulted in the destruction of NUMBER_TOKEN percent of iran's centrifuges used to enrich uranium that attack utilized a now famous vulnerability which exploited a remote code execution bug in windows shortcuts icons as soon as the icon loaded on the target pc malicious code was executed this required no human interaction at all other than opening the folder the exploited file was located in as is obvious hacking
NO_SEGMENT_TOKEN