FLASHFLOOD — Malware Profile

FLASHFLOOD is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps.

MITRE ATT&CK techniques (6)

• T1005 Data from Local System
• T1025 Data from Removable Media
• T1074.001 Local Data Staging
• T1083 File and Directory Discovery
• T1547.001 Registry Run Keys / Startup Folder
• T1560.003 Archive via Custom Method

Attributed threat actors

• APT30

Read the full analysis on IntelFusions