CryptoBandits — USB-LNK worm + Tor hidden-service C2 driving a clipboard hijacker

Microsoft Threat Intelligence documented a multi-component campaign (detected as Trojan:Win32/CryptoBandits.A/B and Trojan:JS/CryptoBandits.A/B), active since at least February 2026, that pairs a removable-media worm with a Tor-fronted clipboard hijacker (Microsoft Security, 2026-06-17; The Hacker News, 2026-06-18). The worm scans attached USB drives for .doc/.xlsx/.pdf files, sets the originals hidden, and replaces them with same-named .lnk shortcuts that launch the payload on user interaction — the classic air-gap-crossing removable-media vector. Once resident, it establishes scheduled-task persistence, launches a renamed portable Tor client opening a SOCKS5 proxy on localhost:9050, and beacons to .onion hidden services over three HTTP endpoints (/route.php beacon, /recvf.php upload, /stub.php payload). The clipboard component polls for cryptocurrency addresses (Bitcoin, Ethereum, Tron, Monero) and silently swaps them, and the C2 supports an EVAL remote-code-execution command. Why it matters to us: the crypto-theft payload is secondary to the propagation model — USB-LNK worms have historically reached isolated and air-gapped administrative environments still common in Swiss public-sector data-transfer workflows, and Tor-fronted C2 defeats domain/IP egress blocking. Detection: WScript/CScript spawning curl.exe/cmd.exe/powershell.exe; outbound SOCKS5 to localhost:9050; scheduled-task creation referencing obfuscated script payloads. Hardening: enforce NoAutorun/NoDriveTypeAutorun, block LNK execution from removable media via ASR, restrict wscript.exe/cscript.exe to signed scripts, and block Tor egress.