Threat reportMalwareTL-2026-3608
Agent.BTZ USB-borne worm infection of US Central Command and DoD networks (2008, Operation Buckshot Yankee) - retrospective on Air Force removable-media mission-planning practices
Agent.BTZ USB-borne worm infection of US Central Command and (TL-2026-3608), also tracked as Operation Buckshot Yankee, is a low-severity malware campaign, first published 2026-10-15. It is linked to a Russia-nexus actor with medium confidence, affects Microsoft Windows (systems with autorun.inf handling enabled), maps to 6 MITRE ATT&CK techniques (T1005, T1025, T1052.001), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3608
- Threat ID
- TL-2026-3608
- Also known as
- Operation Buckshot Yankee, Agent.btz
- Severity
- LOW
- Status
- RESOLVED
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, military
- Target regions
- North America, Middle East
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Agent.BTZ USB-borne worm infection of US Central Command and
Malware and tooling: Agent.btz - S0092, SillyFDC, Trojan-Downloader.Win32.Agent.sxi, Turla, Voronezh.1600, Worm.Win32.Orbina, Turla
How Agent.BTZ USB-borne worm infection of US Central Command and works
A 2026-10-15 retrospective (The Register) recounts how Air Force reliance on USB drives and CDs to move mission-planning data between classified and unclassified systems preceded the 2008 Agent.BTZ infection of US DoD networks, which began with an infected USB drive attached to a laptop with Central Command access. Removal took 14 months and the Pentagon banned USB drives in 2008, permitting them again in 2010 under restricted circumstances.
This record is a historical retrospective, not a new campaign. The Register (2026-10-15) quotes Justin Henkel, SolarWinds CISO and former Air Force IT security, describing a practice dating to the early 2000s of moving mission-planning data between classified and unclassified systems on CDs and USB drives. Pilots used the same devices for both purposes and, per Henkel, did not understand that a USB drive could be written to with malware. Drives were also bought from local Middle Eastern vendors rather than official channels, a supply-chain exposure; Henkel said it was harder to bring a US computer into the country than to buy locally.
In 2008 an infected USB drive connected to a laptop with US Central Command access led to infection of DoD networks with Agent.BTZ, a worm able to harvest information from infected machines and communicate with remote servers. The Register reports it took 14 months to remove the malware from Pentagon systems, that the Pentagon banned USB drives in 2008 and allowed them again in 2010 under certain circumstances, and that a 2016 FBI/DHS report attributed the malware to one or more Russian groups (as stated in the article).
Public technical analysis (Kaspersky Securelist) describes Agent.btz as a variant of the SillyFDC family that spreads by copying itself to other USB drives via autorun.inf, stores harvested system data in a container file (thumb.dd) on removable drives for exfiltration when direct C2 is unavailable, and uses log/component names such as winview.ocx, wmcache.nld and mswmpdat.tlb. Kaspersky found that later Turla (Snake/Uroburos) samples reuse the same XOR key and file names, linking the two codebases. Public reporting dates the Pentagon incident to November 2008 (Operation Buckshot Yankee) and credits it as one driver for creation of US Cyber Command in 2010. No CVE, network IOCs or new exploitation are associated with this retrospective; the value for defenders is removable-media and cross-domain transfer control lessons.
MITRE ATT&CK techniques used in TL-2026-3608
Collection
T1005 Data from Local System; T1025 Data from Removable Media; T1074.001 Data Staged: Local Data Staging
Exfiltration
T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB
Initial Access
T1091 Replication Through Removable Media
Lateral Movement
T1091 Replication Through Removable Media
Command and Control
Affected products and versions in Agent.BTZ USB-borne worm infection of US Central Command and
- Microsoft — Windows (systems with autorun.inf handling enabled)
Vulnerable versions: Systems in US DoD networks in 2008 - US Department of Defense — Central Command-connected laptops and DoD networks incl. SIPRNet/JWICS as publicly reported
Vulnerable versions: 2008
Remediation for Agent.BTZ USB-borne worm infection of US Central Command and
Immediate actions
- Disable autorun/autoplay for removable media on all endpoints
- Block or tightly control USB mass-storage devices on classified and sensitive networks
- Hunt for Agent.btz artifacts: thumb.dd, winview.ocx, wmcache.nld, mswmpdat.tlb, mssysmgr.ocx, fa.tmp
Workarounds
- Enforce device-control policy allowing only approved, encrypted, registered removable media
Longer-term hardening
- Use dedicated, scanned, one-direction cross-domain transfer solutions instead of shared USB drives
- Procure removable media only from vetted supply chains; do not use locally purchased drives
- Train personnel on the risk of reusing the same device across classified and unclassified systems
Timeline of Agent.BTZ USB-borne worm infection of US Central Command and
- Initial Agent.btz variant created, per Kaspersky Securelist analysis (year-level precision)
- Pentagon bans USB drives following the Agent.btz infection
- Agent.btz detected on DoD networks after an infected USB drive was connected to a laptop with US Central Command access (month-level date per public reporting)
- USB drives permitted again under restricted circumstances (public reporting dates the ban as November 2008 to February 2010)
- US Cyber Command reached initial operating capability; public reporting cites the 2008 incident as one driver for its creation (year 2010 per sources; date approximate)
- FBI/DHS report attributes Agent.BTZ to one or more Russian groups, as stated by The Register (year-level precision)
- The Register publishes Justin Henkel's account of Air Force USB/CD mission-planning practices and the Agent.BTZ infection
Sources cited for Agent.BTZ USB-borne worm infection of US Central Command and
- US Air Force pilots used malware-laden USB drives to plan Afghanistan missions
- Agent.btz: a source of inspiration? (Kaspersky Securelist)
- Agent.btz (Kaspersky APT reports)
- Throwback Attack: An attack on the DoD leads to Operation Buckshot Yankee (Control Engineering)
- What was Agent.btz and how did it breach US military networks? (Security Scientist)
- 12 Questions and Answers About Turla (G0010) (Security Scientist)
Detection coverage for TL-2026-3608
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3608 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.