Leaked inner paperwork have revealed that for practically a yr Japan’s Floor Self-Protection Power (JGSDF) used counterfeit USB flash drives contaminated with malware on computer systems related to delicate navy networks. The USB drives have been linked to Chinese language hacking operations, in accordance with an investigation by Nikkei Asia.
Nikkei Asia studies that the poisoned flash drives had been delivered to the JGSDF in March 2024, throughout catastrophe reduction operations following an earthquake in central Japan. By way of this route they had been in a position to enter navy use with out having handed by means of customary procurement channels.
The malware was found in February 2025, after personnel at JGSDF’s Center Military headquarters in Itami, close to Osaka, observed a pc operating unusually slowly. Subsequent investigations discovered that six out of eight USB drives examined contained the identical malicious code.
The contaminated USB drives had been connected to over 50 computer systems, with practically half of these methods used to deal with labeled knowledge, together with details about the motion of troops.
Investigators matched the malware to a pressure beforehand documented by an unnamed US cybersecurity agency, which had linked it to a Chinese language hacking group. Neither the malware household nor the hacking group has been publicly named in studies.
Japan’s Protection Ministry has downplayed the risk, with a spokesperson saying:
“The malware was a legacy kind one restricted to self-replication behaviour and didn’t carry out data exfiltration or exterior communication.”
Including to the confusion, the Epoch Instances studies {that a} spokesperson for the Ishikawa Prefectural Authorities – which had been alleged within the leaked inner paperwork to have supplied the USB drives to the JGSDF throughout the 2024 earthquake reduction effort – stated that “we couldn’t verify any document of procuring the USB drives or paying for his or her buy.”
With neither the prefecture nor the navy in a position to produce a paper path, the origin of the counterfeit drives stays a thriller, elevating additional questions on how simply compromised {hardware} can slip into delicate environments when regular processes are bypassed throughout an emergency.
Nikkei Asia says that the risk posed by the contaminated drives extends past the JGSDF. USB flash drives preloaded with the identical malware have been offered throughout main on-line retail platforms, and infections have been seen at factories and analysis services throughout a number of industries in Japan. The counterfeit drives, priced 30 to 50 p.c beneath genuine manufacturers, had been traced to vendor accounts in China.
In keeping with Nikkei Asia, the JGSDF didn’t disclose the an infection inside its community, regardless of the counterfeit drives remaining extensively out there for buy on-line. The Protection Ministry says it’s persevering with to research the circumstances surrounding acquisition of the drives and intends to implement obligatory virus-scanning safeguards.
Common readers of Sizzling for Safety can be nicely conscious of the risk posed by pre-infected USB drives, the place malware can disguise till a consumer inserts it into their pc.
Clearly organisations have to test that they’re solely shopping for storage gadgets from verified and trusted distributors, and deal with merchandise promoting for a suspiciously low value with warning.
Moreover, it could be smart to scan detachable media on a devoted remoted system previous to connecting it to any company community. As well as, computer systems ought to have any autorun or autoplay performance disabled to forestall malicious code on a USB drive from being routinely activated upon attachment.
