BadUSB / USB drop
Mailed or dropped USB registers as a keyboard and injects a payload
categoryPhysical, insider and cross-cutting attacksseverityHighdetectabilityMediumlabnot yet measured
Example: FIN7 mailed BadUSB
Classification
32 values: 18 imported, 2 derived, 12 machine-classified. What do these mean?
Exploitability
| Attack vector | MalwarePhysical |
|---|---|
| Reach (CVSS) | Physical |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | LinuxmacOSWindows |
| Environment | On-premises |
| Target asset class | EndpointHuman |
| Kill-chain phase (tactic) | Initial AccessLateral Movement |
Detection & telemetry
| Detectability | Medium |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentDrive CreationDriver LoadFile AccessFile CreationModule LoadNetwork Connection CreationNetwork Traffic FlowProcess Creation |
Detection & response
Mitigated by 7
- M1034 attack-mitigation
- M1035 attack-mitigation
- M1040 attack-mitigation
- M1042 attack-mitigation
D3-HCId3fendD3-IOPRd3fendD3-RHd3fend
Detected by 5
- DET0069 attack-detection-strategy
- DET0301 attack-detection-strategy
1a4bd6e3-4c6e-405d-a9a3-53a116e341d4sigmac9eb55c3-b468-40ab-9089-db2862e42137sigmaf69a87ea-955e-4fb4-adb2-bb9fd6685632sigma
Tested by 1
d44b7297-622c-4be8-ad88-ec40d7563c75atomic
Framework references
- Primary source: https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
- attack: T1200 (primary)
- attack: T1091
- capec: CAPEC-457
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 680 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1200, attack:T1091, capec:CAPEC-457 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-457 USB Memory Attacks: CAPEC prerequisites for this pattern
Some level of physical access to the device being attacked. | Information pertaining to the target organization on how to best execute a USB Drop Attack.
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 28 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)