Tick Group Weaponized Secure USB Drives to Target Air-Gapped Critical Systems
Summary: Palo Alto Networks Unit 42 reported that the Tick cyberespionage group, which targets organizations in Japan and South Korea, weaponized a secure USB drive made by a South Korean defense company to reach air-gapped systems. The loader, named SymonLoader, is dropped by a Trojanized Japanese-language GO game found on January 21, 2018, runs only on Windows XP or Windows Server 2003, and extracts an encrypted executable hidden at a physical location on the USB drive that Unit 42 could not obtain.
What's compelling: The malware was built to run only on Windows XP and Windows Server 2003, the out-of-support systems common in air-gapped government, military, and defense environments, and Unit 42 cannot say whether the drives were compromised in the supply chain or after manufacturing.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026