Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

Mandiant Managed Defense has been tracking UNC4990, an actor who heavily uses USB devices for initial infection. UNC4990 primarily targets users based in Italy and is likely motivated by financial gain. Our research shows this campaign has been ongoing since at least 2020.

Despite relying on the age-old tactic of weaponizing USB drives, UNC4990 continues to evolve their tools, tactics and procedures (TTPs). The actor has moved from using seemingly benign encoded text files to hosting payloads on popular websites …

actor age campaign defense devices drives financial hidden infection italy malware managed mandiant old research tactic the age tracking usb usb devices usb drives usb malware