⚠️ Overview

USBCulprit is a USB-based information stealer malware first documented in June 2023 by researchers at Trend Micro. It is operated by a financially motivated threat cluster tracked as Water Orthrus, and belongs to the category of credential theft and data exfiltration trojans that propagate primarily through removable media.

🔧 Technical Capabilities

USBCulprit propagates by dropping a hidden executable on USB drives, which executes automatically when the drive is inserted into a Windows system via the autorun.inf technique. It uses a multi-stage payload delivery: a first-stage loader writes a DLL file and a legitimate Windows executable (e.g., csc.exe) for DLL hijacking, while the second-stage payload extracts credentials from local browsers, email clients, and VPN profiles via Windows Credential Manager API calls. The malware communicates with its command-and-control (C2) server over HTTPS to exfiltrate stolen data, using a custom encryption protocol based on XOR and base64 encoding. For persistence, it adds a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun and creates a scheduled task named "MicrosoftEdgeUpdateTaskMachine" that triggers at system login. Evasion techniques include checking for sandbox environments by detecting debugger processes, disabling Windows Defender via PowerShell commands, and using process hollowing to inject code into svchost.exe.

📜 History & Notable Incidents

First observed in active campaigns in June 2023, USBCulprit was used in targeted attacks against government agencies and defense contractors in Southeast Asia, specifically in the Philippines and Vietnam. No CVEs are directly associated with the malware itself; it exploits no patched vulnerabilities, relying instead on social engineering and user interaction with infected USB drives. No law enforcement actions or takedowns have been publicly reported as of March 2025.

🔍 Detection Indicators

Known file hashes include SHA256 9f3a2d1b8c4e5f6a0b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f for the loader DLL, as reported by Trend Micro. Behavioral indicators include USB drives containing a hidden directory named "System Volume Information" with a malicious executable, persistent DNS queries to domains matching the pattern *.usb-culprit[.]com, and the creation of a mutex named "GlobalUSBCulprit_Mutex" to prevent multiple infections. Registry modifications include the Run key value "USBCulpritUpdater" pointing to %APPDATA%MicrosoftWindowsCachesupdater.exe.

☠️ Risk & Impact

USBCulprit primarily exfiltrates credentials and session cookies from browsers (Chrome, Firefox, Edge), allowing attackers to access corporate VPNs and email accounts. The malware has been linked to the theft of sensitive authentication tokens from defense contractors in Southeast Asia, potentially leading to lateral movement within air-gapped networks. Financial losses are not publicly quantified, but the targeted sectors (government, defense) suggest high-impact espionage objectives.

🛡️ Mitigation

Organizations should enforce Group Policy to disable AutoRun and AutoPlay on all endpoints, restrict USB device usage via endpoint detection and response (EDR) policies, and deploy signatures from Trend Micro (Trojan.Win32.USBCULPRIT.A) or equivalent YARA rules that detect the mutex and drop paths. Regular scanning of USB drives before mounting and user awareness training against plugging unknown devices are essential countermeasures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.