USBStealerMalware
- usb stealer
- win32/usbstealer
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 27 · each with the sentence it comes from- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“T1056.001”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“GammaSteel: All stealer components (encompassing malware previously known as QuietSieve, USBStealer, HarvesterX, and various Pteranodon stealer modules).”
-
Sednit recargado: un APT histórico reactiva su arsenal“…dreco, hasta toolkits especializados como la herramienta de network pivoting Xtunnel y el data stealer para máquinas air‑gapped USBStealer.”
-
Sednit reloaded: Back in the trenches“… as Xagent and Sedreco, to specialized toolkits such as the network-pivoting tool Xtunnel and the data stealer for air-gapped machines USBStealer.”
Indicators in its reports
named in the reports above- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- 1794369214b7f62e70a0485e61335c61in 1 report
- hxxp://iiwdsxwamylbwwsoyrmj.supabase[.]co/functions/v1/clever-responder/KokonGoogle_09.12.2025in 1 report
- hxxps://[email redacted][.]co/functions/v1/clever-responder/GurGoogle_09.12.2025/audience/capture.pdfin 1 report
- 8e1624d110c090ff57d4b493a9107c66in 1 report
- hxxps://graph[.]org/in 1 report
- graph[.]orgin 1 report
- 104.194.140[.]6in 1 report
- moment-cat-qld-place.trycloudflare[.]comin 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.