#ESETresearch has published a comprehensive whitepaper comparing all known malware frameworks designed to breach air-gapped networks. Read more: welivesecurity.com/2021/12/01/jum… @adorais @0xfmz 1/7
@adorais @0xfmz In the first half of 2020 alone, 4 previously unknown malicious frameworks emerged, bringing the total, by our count, to 17. This sparked our interest into doing this research. 2/7 
@adorais @0xfmz This work allowed us to formalize what defines an air-gapped network malware and to propose a terminology to accurately describe the various components at play. 3/7
@adorais @0xfmz We also examined the 4 main sets of characteristics relevant to this special type of malware: connected side & air-gapped side execution vectors, air-gapped side functionalities, and of course, communication & exfiltration channels. 4/7
@adorais @0xfmz Three key findings of our research:
-USB drives have been the ONLY medium used by malware to transfer data across air gaps. We found no evidence of malware using other covert transmission mediums such as acoustic or electromagnetic signals. 5/7
-USB drives have been the ONLY medium used by malware to transfer data across air gaps. We found no evidence of malware using other covert transmission mediums such as acoustic or electromagnetic signals. 5/7
@adorais @0xfmz -All frameworks were designed for espionage purposes and only targeted Windows systems
-Some techniques to compromise the initial system in air-gapped networks required user interaction, some didn’t, and some relied on assets with physical access to the system. 6/7
-Some techniques to compromise the initial system in air-gapped networks required user interaction, some didn’t, and some relied on assets with physical access to the system. 6/7
• • •
Missing some Tweet in this thread? You can try to
force a refresh
