# Agent.BTZ USB-borne worm infection of US Central Command and DoD networks (2008, Operation Buckshot Yankee) - retrospective on Air Force removable-media mission-planning practices

> A 2026-10-15 retrospective (The Register) recounts how Air Force reliance on USB drives and CDs to move mission-planning data between classified and unclassified systems preceded the 2008 Agent.BTZ infection of US DoD networks, which began with an infected USB drive attached to a laptop with Central Command access. Removal took 14 months and the Pentagon banned USB drives in 2008, permitting them again in 2010 under restricted circumstances.

- **Published:** 2026-10-15T10:45:36Z
- **Last reviewed:** 2026-10-15T10:45:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3608
- **ID:** TL-2026-3608
- **Severity:** LOW
- **Category:** MALWARE
- **Status:** RESOLVED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record is a historical retrospective, not a new campaign. The Register (2026-10-15) quotes Justin Henkel, SolarWinds CISO and former Air Force IT security, describing a practice dating to the early 2000s of moving mission-planning data between classified and unclassified systems on CDs and USB drives. Pilots used the same devices for both purposes and, per Henkel, did not understand that a USB drive could be written to with malware. Drives were also bought from local Middle Eastern vendors rather than official channels, a supply-chain exposure; Henkel said it was harder to bring a US computer into the country than to buy locally.

In 2008 an infected USB drive connected to a laptop with US Central Command access led to infection of DoD networks with Agent.BTZ, a worm able to harvest information from infected machines and communicate with remote servers. The Register reports it took 14 months to remove the malware from Pentagon systems, that the Pentagon banned USB drives in 2008 and allowed them again in 2010 under certain circumstances, and that a 2016 FBI/DHS report attributed the malware to one or more Russian groups (as stated in the article).

Public technical analysis (Kaspersky Securelist) describes Agent.btz as a variant of the SillyFDC family that spreads by copying itself to other USB drives via autorun.inf, stores harvested system data in a container file (thumb.dd) on removable drives for exfiltration when direct C2 is unavailable, and uses log/component names such as winview.ocx, wmcache.nld and mswmpdat.tlb. Kaspersky found that later Turla (Snake/Uroburos) samples reuse the same XOR key and file names, linking the two codebases. Public reporting dates the Pentagon incident to November 2008 (Operation Buckshot Yankee) and credits it as one driver for creation of US Cyber Command in 2010. No CVE, network IOCs or new exploitation are associated with this retrospective; the value for defenders is removable-media and cross-domain transfer control lessons.

## MITRE ATT&CK

- T1091 Replication Through Removable Media
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1025 Data from Removable Media
- T1074.001 Data Staged: Local Data Staging
- T1092 Communication Through Removable Media
- T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB

## Sources

- [US Air Force pilots used malware-laden USB drives to plan Afghanistan missions](https://www.theregister.com/security/2026/10/15/us-air-force-pilots-used-malware-laden-usb-drives-to-plan-afghanistan-missions/5303156)
- [Agent.btz: a source of inspiration? (Kaspersky Securelist)](https://securelist.com/agent-btz-a-source-of-inspiration/58551/)
- [Agent.btz (Kaspersky APT reports)](https://securelist.com/agent-btz)
- [Throwback Attack: An attack on the DoD leads to Operation Buckshot Yankee (Control Engineering)](https://www.controleng.com/throwback-attack-an-attack-on-the-dod-leads-to-operation-buckshot-yankee/)
- [What was Agent.btz and how did it breach US military networks? (Security Scientist)](https://answers.securityscientist.net/q/21194/what-was-agent-btz-and-how-did-it-breach-us-military-networks)
- [12 Questions and Answers About Turla (G0010) (Security Scientist)](https://www.securityscientist.net/blog/12-questions-and-answers-about-turla-g0010/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3608