30
Tick Group Weaponized Secure USB Drives to Target Air
Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.
Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.
42
35
30
30
30
30
35
30
30
30
45
35
50
45
35
30
30
30
30
Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.
The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.
62
30
30
30
30
30
30
30