Counterfeit USB Drives Undermine Japanese Military Security: A Year of Undetected Malware
In a troubling incident that underscores vulnerabilities within emergency protocols, Japan’s Ground Self-Defense Force (JGSDF) unknowingly employed counterfeit USB drives infected with malware for nearly a year before detection in February 2025. This incident reveals a pathway through which military networks can be compromised, highlighting the importance of stringent procurement practices, especially in crisis scenarios.
The malware-laden USB drives, tied to Chinese hacking operations, infiltrated over 50 computers within JGSDF facilities, with approximately half of these systems managing classified information, such as troop movements. The infection came to light at the Middle Army headquarters in Itami, where personnel observed a decline in computer performance. This prompted further investigation, which confirmed that six out of the eight tested USB drives contained identical malicious code.
The entry point for these infected devices raises serious concerns. They found their way into military operations during earthquake relief efforts in central Japan in March 2024, circumventing standard procurement processes entirely. Alarmingly, neither the JGSDF nor the Ishikawa Prefectural Government, which is alleged to have supplied the drives, has been able to provide records of purchase or payment. This lack of documentation accentuates how emergency situations can inadvertently create security gaps when the usual vetting procedures are relaxed.
Investigators tracing the malware back to its origins noted that it matched a strain previously documented by a U.S. cybersecurity firm and connected to a Chinese hacking group. However, the specific malware family and the exact threat actor behind the operation remain unconfirmed in any public disclosures.
Japan’s Defense Ministry, while acknowledging the breach, has positioned the threat as limited in scope. Officials claim that the malware is a legacy variety, capable only of self-replication without the ability to exfiltrate information or communicate with external systems. Despite this reassessment of the immediate danger, the ramifications of the infection extend significantly beyond military networks. The counterfeit drives, which were priced 30 to 50 percent lower than authentic models, have been identified as a source of infection in factories and research facilities across numerous Japanese industries. Current investigations reveal that seller accounts traced back to China persist in offering these compromised USB devices, despite the evident security threats they pose.
The fact that systems managing critical military data were allowed to be compromised poses serious implications about cybersecurity practices in high-stakes environments. Although the Defense Ministry downplays the immediate risks attributed to the malware’s limited functionality, the incident clearly illustrates how easily compromised hardware can infiltrate secure systems. Disturbingly, even after the JGSDF became aware of the malware infection, the counterfeit USB devices remained readily available for purchase online, with no immediate public disclosure of the situation to inform potential buyers.
To mitigate risks posed by such scenarios, organizations have a responsibility to adopt multiple protective measures against pre-infected USB drives. Firstly, they are urged to purchase storage devices solely from verified and trusted vendors, and to approach suspiciously low-priced products with an appropriate level of caution. Moreover, all removable media should be scanned on dedicated, isolated systems prior to being linked to corporate networks. Disabling autorun and autoplay features across all computers can also significantly curb the risk of automated execution of malicious code when USB drives are introduced into secure environments.
In light of this breach, the JGSDF is actively continuing its investigation and is implementing new protocols aimed at enhancing cybersecurity measures, including mandatory virus-scanning safeguards for all storage devices used within its networks. This incident serves as a critical reminder of the intricate relationship between procurement practices, emergency response, and cybersecurity, particularly within organizations tasked with protecting sensitive information. The discovery of such vulnerabilities calls for a comprehensive reassessment of security measures across all sectors, emphasizing that vigilance must remain paramount in protecting against evolving cyber threats.