TetrisPhantom — APT Profile
TetrisPhantom is the name Kaspersky's GReAT team gave to an espionage operation against government bodies in the Asia-Pacific region, first detected in early 2023. The campaign is built around a hardware-encrypted USB drive model issued to state employees for physically moving sensitive data between systems: according to Kaspersky's Q3 2023 APT review, the attackers injected their code into the legitimate access-management program shipped on the drive's unencrypted partition, which then loaded the malware on each new host. A modular toolset runs operator commands, harvests documents and host information, and ferries the results back out on the same encrypted drives. Because the implants replicate onto any secure drive plugged in, the operation reached air-gapped machines, and its components were shielded with virtualization-based obfuscation while talking to the drives through raw SCSI commands. Kaspersky described an extremely narrow victim set and assessed the operator as well-resourced and skilled, with an interest in protected government networks; no country attribution has been published.
IntelFusions coverage (1)
Tools & malware
- AcroShell backdoor
- ExportUSB file collector / exfiltration
- GetUSB file collector
- Trojanized UTetris.exe loader
- USBDC reconnaissance
- XMKR USB worm / persistence module
Vendor research
Read the full analysis on IntelFusions