Tick__2019__Tick_Group_Weaponized_Secure_USB_Drives_to_Target_Air-Gapped_Critical_Systems.pdf

Unit 42 reports a historic Tick Group operation weaponizing secure USB drives to target air-gapped critical Windows systems. The attackers trojanize legitimate software to drop a loader (SymonLoader) that detects a specific secure USB, extracts a hidden payload, and can install additional modules such as HomamDownloader, illustrating a sophisticated USB-based attack against air-gapped environments, though no active campaign is evidenced.