H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[USBStealer](https://attack.mitre.org/software/S0136) is malware that has been used by [APT28](https://attack.mitre.org/groups/G0007) since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with [ADVSTORESHELL](https://attack.mitre.org/software/S0045). (Citation: ESET Sednit USBStealer 2014) (Citation: Kaspersky Sofacy)

Labels

malware

15 recorded

Relationships

uses

from APT28

Group

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Communication Through Removable Media

Technique

uses

to Data from Removable Media

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration over USB

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Local Data Staging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Replication Through Removable Media

Technique

uses

Technique

3 external

References

mitre-attack

S0136

ESET Sednit USBStealer 2014

http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/

Kaspersky Sofacy

https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/