FIN7 BadUSB Mailings via USPS Behind a Forged "Best Buy" Gift Card Lure

What happened

FireEye estimated in March 2020, from malware submission dates it observed in VirusTotal, that the campaign ran back to at least December 2019. It continued through 2020, with related mailings resurfacing in 2021. The FIN7 cybercrime group (also known as Carbanak) mailed USPS packages to HR, IT, and executive staff at US retail, restaurant, and hotel companies. The FBI's account of the contents is deliberately generic: the packages "sometimes include items like teddy bears or gift cards," and the enclosed USB was a commercially available "BadUSB" or "Bad Beetle USB," several of the observed devices carrying LILYGO branding, all of them silver with a swivel cover. The one package that was recovered and taken apart carried a forged Best Buy letter offering a $50 gift card, with the USB presented as holding the list of items the card could be spent on. That USB was a hardware keystroke-injection device (an Arduino Leonardo/ATMEGA32U4-class board, marked "HW-374") that, when plugged into a computer, automatically typed commands to launch an obfuscated PowerShell chain, fetch a second-stage script from an attacker-controlled domain, and install a JavaScript backdoor performing system reconnaissance and command-and-control beaconing. The FBI identified that payload as GRIFFON malware. Trustwave SpiderLabs obtained and reverse-engineered the package, received by a US hospitality-sector organization in mid-February 2020; the recipient had security awareness training, recognized the mailing as suspicious, and did not connect the device.

Best Buy was impersonated, not involved. The retailer's branding was forged on the single package Trustwave analyzed. Best Buy was not compromised, was not a party to the campaign, and is named nowhere in either FBI alert. The only organizations the FBI names as impersonated are the US Department of Health and Human Services and Amazon, both in the January 2022 update. The brand survives in this case's id and page title because the id is the live URL, and renaming it needs a redirect and a dataset version bump.

The objective the FBI gave for these 2020 mailings was payment card theft, not ransomware. The March 2020 alert states it directly: "FIN7's goal is to target and steal payment card data from Point of Sale (POS) systems on a compromised network." Ransomware enters the record only with the January 2022 update, which describes a shifted toolset (DICELOADER, TIRION) and says FIN7 "seeks to deploy ransomware within a compromised network." The FBI issued FLASH MI-000120-MW on March 26, 2020 to the retail, restaurant, and hotel industries, and updated it as MU-000160-MW on January 6, 2022. Both were restricted-distribution alerts to industry partners rather than public warnings: the 2022 copy is marked TLP:GREEN and states that its contents "may be shared with peers and partner organizations within your sector or community, but not via publicly accessible channels."

How it worked

The attack combined a physical social-engineering lure with a hardware exploit. The recipient in the documented case received a USPS package with an official-looking letter carrying forged Best Buy branding, thanking them for being a loyal customer and enclosing a purported $50 gift card, accompanied by a USB drive. The letter framed the USB as containing a list of items the gift card could be redeemed for, encouraging the recipient to plug it in to see. Teddy bears and gift cards appear in the FBI's separate, generic description of what these packages contained, not in this package. The USB was not a storage device but a BadUSB-style hardware implant (Trustwave identified it as an Arduino Leonardo-class board with an ATMEGA32U4 microcontroller, PCB marked "HW-374") that emulates a USB keyboard (HID device). Once inserted, it auto-typed a keystroke injection sequence that opened a command line and ran an obfuscated PowerShell command with no user interaction beyond plugging it in. That command pulled a second-stage script from the attacker staging domain milkmovemoney[.]com/st/mi.ini, copied wscript.exe to %AppData%MicrosoftWindowswipre.exe, dropped an obfuscated JScript file (prada.txt), popped a convincing fake message box to cover what was happening, and executed a JavaScript backdoor. The backdoor's command-and-control address is a separate host, which Trustwave redacted in its published analysis. The backdoor registered the host with a command-and-control server and harvested extensive system reconnaissance data (username, hostname, domain, OS build/version, user privileges, running processes, installed Office/Adobe products, hardware/memory info, timezone). The FBI named that payload outright as GRIFFON malware, and FireEye's technical director described the chain as launching an instance of the GRIFFON backdoor; Trustwave itself never named a malware family, so the identification rests on the FBI and FireEye rather than on the teardown. Packages were mailed to HR, IT, and executive-management staff at retail, restaurant, and hotel businesses, exploiting the trust and low suspicion generated by an ordinary-looking package from a familiar consumer brand.

The lure and the tell

The Tell: an unsolicited package arriving via USPS, "from" a well-known retailer (Best Buy) the recipient likely never contacted, containing a USB drive plus a gift pretext, a purported $50 gift card, with a letter urging the recipient to plug the USB in to "see what it can buy," a classic too-good-to-be-true reciprocity hook combined with curiosity bait, sent to a business address (HR/IT/executive) rather than a home, which is itself atypical for genuine retail promotions. The device also physically resembled repurposed low-cost hobbyist hardware (Arduino Leonardo/HW-374 board) rather than an actual USB flash drive. In the documented case the recipient caught the incongruity, an unsolicited gift tied to a USB device mailed to a business, and did not plug it in. Trustwave credits security awareness training for that outcome, and no source describes an internal security team being involved. The training was the save.

Outcome

The February 2020 package was stopped before any device was connected. The recipient, at a US hospitality-sector organization, recognized the mailing as suspicious and did not plug the drive in. It reached Trustwave SpiderLabs through one of the firm's incident response retainer clients, with whom the recipient had a business relationship, which let Trustwave disassemble the hardware and payload safely. No confirmed compromise, data breach, or financial loss has been publicly reported from this specific package.

The wider result deserves stating plainly, because it is the unusual part. Across nearly two years of FBI reporting on these mailings, no recipient organization was ever publicly identified, and no successful intrusion was ever publicly documented as originating from one of them. As late as January 2022 the FBI was still asking targets to come forward, requesting "the original mailing package sent to your organization, including all contents." A campaign that nobody is on record as having fallen for is still a case worth teaching, and it is filed here as one.

The FBI issued FLASH MI-000120-MW on March 26, 2020 to the retail, restaurant, and hospitality industries, and updated it as MU-000160-MW on January 6, 2022, after similar mailings resurfaced through 2020 and again in August and November 2021 against transportation, insurance, and defense targets. The genuine changes the 2022 alert records are the HHS and Amazon lures, the decorative gift box, counterfeit gift cards, delivery by UPS alongside USPS, and the ransomware objective. LilyGO-branded devices are not among them: the March 2020 alert already reported those. Both alerts were restricted-distribution products for industry partners rather than nationwide public warnings, which is why every copy citable here is a third-party mirror. The 2022 update describes FIN7 deploying ransomware including BlackMatter and REvil on compromised networks, but never says that any of that access came from a mailed USB device.

Why it matters

This case is one of the best-documented real-world examples of a nation-scale criminal group operationalizing physical mail as an initial-access vector, bridging "digital" cybercrime with old-fashioned baiting: instead of a phishing email, the lure was a tangible package that exploited reciprocity (an unexpected gift), curiosity, and trust in a household retail brand, sent specifically to roles (HR, IT, executives) who routinely receive vendor mail and may be less trained to distrust physical hardware than a suspicious email attachment. It demonstrates that security awareness training must extend beyond email and phishing to cover unsolicited physical devices and mail-borne lures. It also shows how thin the technical backstop is against this particular device. The FBI's own guidance is that blocking removable storage will not stop it, because it presents itself as a keyboard, which leaves alerting on its USB vendor and product identifiers, PowerShell logging, and hardware-ID allow-listing as the realistic controls. FIN7 is one of the most financially damaging cybercrime groups on record. The Department of Justice states that in the United States alone the group breached companies in all 50 states and the District of Columbia and stole more than 20 million customer card records from over 6,500 point-of-sale terminals at more than 3,600 separate business locations (DOJ, April 2021, measured from the case record). A prosecutor put the total higher still, saying the defendant "and his conspirators compromised millions of financial accounts and caused over a billion dollars in losses to Americans and costs to the U.S. economy" (Acting Assistant Attorney General Nicholas L. McQuaid, April 2021); that is an assertion at sentencing, not a measured figure, and the same release describes the billion-dollar scale as an estimate. The campaign illustrates how a group operating at that scale will still invest in low-tech, high-trust delivery when it offers a path around email security controls.

Defenses

The FBI's Recommended Mitigations in FLASH MI-000120-MW, repeated with light rewording in MU-000160-MW, are four items and no more:

• "Do not plug in any unknown USB devices to any computer system."
• "Implement monitoring or alerts for any endpoints that plug in a USB device with a VID of 0x2341 and PID of 0x8037."
• "Update endpoints to PowerShell version 5 or higher, and turn on PowerShell logging through the Group Policy Editor, including module logging, script block logging, and transcription. Organizations should also increase their PowerShell event log size to 1GB or higher to ensure logs are not quickly overwritten."
• "Although it will not prevent these USB devices from operating, if feasible for your business operations, for general additional security you can disable access to all Removal Storage in the local group policy editor allowing only the machine administrator access to the computer in a network environment."

The fourth item is worth reading twice, because blocking removable storage is the control most people reach for and the FBI says in both alerts that it does not work here. The 2020 alert: "This device will still operate on networks with removal storage devices disabled, since the USB registers as a Keyboard HID Keyboard Device (an I/O device) when plugged into a computer." The 2022 alert says the same thing again. Disabling autorun fails for the same reason, and is worth naming because it is the reflex advice for a mailed USB: autorun governs mounted removable storage, and this device never presents as storage. Neither FBI alert mentions autorun, and neither does Trustwave.

The published indicators split the same way. The FBI gave a hardware signature, the vendor ID 0x2341 and product ID 0x8037 the device registers under, plus physical tells: packages that may include letters, gift cards and other items, USB devices sometimes carrying the recipient's name in marker, several of them LilyGO-branded, all of them silver with a swivel cover. Neither alert publishes a domain, an IP address or a hash. The network indicators belong to Trustwave: two payload hashes and the staging domain milkmovemoney[.]com.

Two further controls are ours or our sources', not the FBI's, and are labeled as such. BleepingComputer's coverage of the alert recommends in its own voice that "organizations can take precautions against attacks via malicious USB drives by allowing only vetted devices based on their hardware ID and denying all others." And mailroom handling that treats an unsolicited package containing a USB device, a gift card or an unexpected gift addressed to HR, IT or an executive as a security matter rather than as internal mail is sound practice, but it appears in no source cited here.

Reporting goes to a local FBI field office or to FBI CyWatch, per the Reporting Notice in both alerts. The only IC3 address in the 2022 alert is a product feedback survey, not an incident reporting channel.

The documented 2020 case shows the control that actually worked, and it was none of the technical ones. The person who received the package had security awareness training, recognized the lure, and did not plug the device in.