USB drives carrying China-linked malware infected Japanese military networks for nearly a year

Internal documents indicate that counterfeit USB drives infected with malware, linked to Chinese state-sponsored operations, were used on sensitive Japanese military networks for nearly a year. The Ground Self-Defense Force (JGSDF) reportedly received these compromised drives in March 2024, during disaster relief efforts following an earthquake in central Japan. This bypass of standard procurement channels allowed the infected devices to enter use within the military.

The malware was detected in February 2025 by personnel at the JGSDF's Middle Army headquarters in Itami. A computer was observed to be operating unusually slowly, prompting an investigation. This inquiry revealed that six out of eight tested USB drives contained the same malicious code. These infected drives had been connected to more than 50 computers, with almost half of these systems handling classified information, including details on troop movements.

Investigators traced the malware to a known strain previously documented by an unnamed U.S. cybersecurity firm, which had attributed it to a Chinese hacking group. However, neither the specific malware family nor the associated hacking group has been publicly identified.

The Japanese Defense Ministry has sought to minimize the perceived threat. A spokesperson stated that the malware was an older type, limited to self-replication, and did not engage in data exfiltration or external communication.

Adding to the uncertainty surrounding the incident, a spokesperson for the Ishikawa Prefectural Government, which had been implicated in leaked documents as the entity that provided the USB drives to the JGSDF during the earthquake relief, stated that there were no records confirming the procurement or payment for these drives. The lack of a clear paper trail from either the prefecture or the military raises questions about how compromised hardware can infiltrate sensitive environments, particularly when emergency situations lead to the circumvention of normal acquisition processes.

The reach of the threat appears to extend beyond the JGSDF. Reports suggest that USB flash drives preloaded with the same malware have been offered for sale on major online retail platforms. Infections have also been observed in factories and research facilities across various sectors in Japan. These counterfeit drives, priced significantly lower than genuine brands, were traced to seller accounts located in China.

Despite the ongoing availability of these compromised drives for purchase online, the JGSDF reportedly did not disclose the network infection. The Defense Ministry has indicated that it is continuing its investigation into how the drives were acquired and plans to implement mandatory virus-scanning protocols.

This incident highlights the persistent threat posed by pre-infected USB drives, where malware can remain dormant until activated upon insertion into a computer. Organizations are advised to procure storage devices exclusively from verified vendors and to exercise caution with products offered at suspiciously low prices. Furthermore, scanning all removable media on an isolated system before connecting it to a corporate network is a recommended security practice. Disabling autorun or autoplay functionality on computers can also help prevent the automatic execution of malicious code from USB drives.