FBI Warns About USB Drop Attack From FIN7

The Federal Bureau of Investigation has issued a warning about Eastern European cybercriminal group FIN7, which tried to hack U.S. transportation, defense and insurance companies by mailing fake letters.

According to an FBI advisory, companies received fake snail mails that were processed by the U.S. Postal Service and courier service company UPS from August to November. The cybercriminal group pretended to be from the Department of Health and Human Services in some instances and Amazon in others.

The mail contained a USB stick that harbored malicious software instead of an Amazon gift card or COVID-19 guidance from the HHS. If unsuspecting users insert the hardware into a computer, hacking groups would have gained access to networks and will have the ability to deploy ransomware. It is unclear if any of the companies were impacted by the hacking attempt, CNN reported.

The FBI asked organizations that received a package from the hacking group to keep the parcel protected and to preserve any identifying marks that could give the bureau some hints about FIN7.

FIN7 is known for its attacks on consumers and businesses in the U.S. and abroad. The Department of Justice and the FBI have been tracking the organization for years but have not successfully pinned it down. FIN7 is continuing to evolve despite law enforcement agencies capturing some of its members. In 2018, the Department  of Justice arrested three Ukrainian men who claimed to be high-profile members of the organization. A U.S. judge sentenced the accused to 10 years in prison.

The cybercrime group had used USB drop attacks in the past. In February 2020, FIN7, or an organization operating on its behalf, sent a USB device to a U.S. hospitality organization an alleged Best Buy gift card that contained the malicious hardware.