February 5, 2023

The US FBI issued a warning that the financially motivated group FIN7 has sent malicious USB devices, BadUSB devices, to US companies over the past few months to infect their systems with the malware.

The group uses weaponized USB devices with the LilyGO logo, which are sent to the victims via United States Postal Service and United Parcel Service.


FIN7 using this technique to target businesses in the transportation and insurance industries since August 2021, while it started targeting defense firms since November 2021.

The operators impersonate Amazon and the US Department of Health & Human Services  (HHS) to trick the victims into opening the packages and plugging the BadUSB devices into their systems.

Since August 2021, the FBI has received reports of several packages containing these USB devices, sent to US businesses in the transportation, insurance, and defense industries. The packages were sent using the United States Postal Service and United Parcel Service.There are two variations of packages those imitating HHS are often accompanied by letters referencing COVID-19 guidelines enclosed with a USB; and those imitating Amazon arrived in a decorative gift box containing a fraudulent thank you letter, counterfeit gift card, and a USB.

Alert Statement

Upon plugging the USB thumb drives into a computer, a BadUSB attack is triggered and the devices act as a keyboard (HID Emulator USB) to send commands to the system.


The attack would run PowerShell commands to download and install malicious payloads, including BlackMatter and REvil ransomware. The FIN7 group used a broad range of tools and malware such as Metasploit, Cobalt Strike, PowerShell scripts, Carbanak, GRIFFON, DICELOADER, TIRION. It will obtain administrative access and moved laterally within the target network.

Leave a Reply

%d bloggers like this: