Malware-Laced USBs Breach Japanese Navy Networks

Cyberwarfare / Nation-State Assaults
,
Endpoint Safety
,
Fraud Administration & Cybercrime

Reused USB Drives Linked to China Unfold Malware to Personal Sector

Greg Sirico •
June 26, 2026    

Counterfeit flash drives embedded with a Chinese language-linked laptop virus and utilized by the Japanese military at the moment are shelling out malware all through different safe networks within the nation.

See Additionally: New Assaults. Skyrocketing Prices. The True Price of a Safety Breach.

First reported by The Nikkei newspaper, the virus was ignored till February 2025, when navy personnel reported slower gadget speeds – nearly a full 12 months after the flash drives had been delivered to Japan’s Self-Protection Forces in March 2024.

In keeping with inner paperwork, the unique supply of procurement for the drives is not verifiable. An investigation by the military’s Cyber Protection Unit discovered that six of eight USB drives analyzed contained the trojan horse, with greater than 50 out of 480 computer systems contaminated. Roughly half of the computer systems affected ran on closed inner networks.

Each Japan’s Self-Protection Forces and Protection Ministry depend on open and closed techniques, utilizing closed or remoted networks for storing labeled navy knowledge corresponding to unit actions or orders, usually transferring knowledge externally with USB flash drives.

The Protection Ministry stated the malware had “no affect” on navy techniques, with no proof of “info exfiltration or exterior communication.”

Researchers attribute the malware unfold to customers connecting the counterfeit drives to computer systems and reusing the units on any variety of non-government techniques, permitting the an infection to unfold past navy networks and into private-sector organizations.

The malware household is linked to Chinese language-aligned APT group Mustang Panda, although no attribution has been publicly confirmed. Often known as Earth Preta or Camaro Dragon, the menace group is linked to a number of cyberespionage campaigns utilizing detachable or moveable media to load viruses, acquire community entry and exfiltrate delicate knowledge.

The fact is that moveable media is crucial to how infrastructure operates and is probably going right here to remain, stated InfraShield President and CEO Mark Rorabaugh.

“Transportable media is just not going away. Vital infrastructure operators depend on USB drives and different detachable media day-after-day for software program updates, diagnostics, engineering actions, knowledge assortment and vendor help,” Rorabaugh stated.

“The aim shouldn’t be to remove moveable media, however to handle it securely.”

Blended cyber-physical operations are sometimes ignored within the broader cyberthreat panorama, and so they depend on human habits and social engineering as a lot as technological gaps, with most individuals viewing USB drives extra as “handy productiveness” instruments and fewer as a “potential weapon” used towards safe environments.

Rorabaugh provided a sentiment well-aligned with navy operations: “Introducing an unauthorized USB gadget right into a safe atmosphere is the cyber equal of carrying a stay grenade by way of the entrance door of a protected facility.”

In keeping with The Nikkei, malicious flash drives stay on the market by way of on-line retailers in China nevertheless it did not disclose the particular malware household focusing on Japan’s main navy department. USB utilization for file and data sharing is a core element of many main industries corresponding to healthcare, training, manufacturing and finance – a few of which at the moment are reporting comparable infections on closed techniques in Japan.

In recent times, U.S. intelligence businesses foretold of a rise in refined cyberattacks carried out by China-linked hackers and menace teams by way of embedded malware campaigns on the US and different nations.

In the US alone, regulation companies, main telecoms and even skilled social media platforms corresponding to LinkedIn have been exploited, with detachable or moveable media representing only one useful resource in China’s huge cyberespionage toolkit.