ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Drive”

575 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 2040Vulnerability 1731Ransomware 1646Malware 1445Policy & legal 1245Data breach 752Phishing & fraud 595Threat actor 575Exploit / PoC 527AI tools & infra 308AI safety & security 182Advisory 165AI industry 161Research 141
SeverityAllcritical 4322high 2430medium 1724low 2548info 749

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild1

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabzupdated · 3h agofirst · 22h agoThreat actor in the wild 3 sources

APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks

Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.

Zscaler identified in August 2026 a campaign tracked as RapidRust in which APT36 uses infected removable drives to reach air-gapped government environments in India and Afghanistan. RUSTYMOVE, a Rust USB-spreading utility, copies a fake-PDF shortcut and the RUSTYSHADE backdoor to removable media; RUSTYSHADE uses attacker-controlled private GitHub repositories for C2, running shell commands, capturing screenshots and webcam images, while PSNATCH and BASHNATCH steal files. Operators enumerated users, shares, and remote administrative shares to expand beyond initial victims, with payloads staged on lookalike domains mimicking Indian media outlets and Backblaze B2 storage.

Cyber Security News · 3h agoThreat actor in the wild 3 sources