Technology

59436 readers

3636 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

209

Two never-before-seen tools, from same group, infect air-gapped devices (arstechnica.com)

submitted 1 month ago by [email protected] to c/[email protected]

46 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 41 points 1 month ago* (last edited 1 month ago) (1 children)

It's weird for the title to focus on the tools, and not the attack itself.

Two attacks on production air-gapped networks, with different tools, from the same group, is pretty damn impressive. Especially for a group not backed by a nation-state.

Edit: it sounds like this was a multi-stage attack...compromising a production non-airgapped internal system and using that to create the USB payload and later exfiltration. That's pretty cool. The mule who brought the infected USB into the air-gapped space was likely none the wiser...the media had been written by them, to their own USB, and probably even hardware encrypted at rest (something like an Apricorn).

[–] [email protected] 0 points 1 month ago

it sounds like this was a multi-stage attack...compromising a production non-airgapped internal system and using that to create the USB payload and later exfiltration. That's pretty cool. The mule who brought the infected USB into the air-gapped space was likely none the wiser...the media had been written by them, to their own USB, and probably even hardware encrypted at rest (something like an Apricorn).

Yeah, that's pretty damn impressive.