Skip to main content

Agent.BTZ (aka Autorun) - week 2


Agent.BTZ is possibly one of the most famous cyber attacks in American history. In 2008, a flash drive with the bug was inserted into a computer at a military base in the Middle East. Once in, it spread to other systems. To combat the bug, the military created a task force called ‘Yankey Buckshot’. This task force was tasked with containing the bug, which took nearly 14 months to do.

This bug spreads by generating a AUTORUN.INF file in each drive it can reach. It then scans the system for useful data, opens a backdoor, and sends the information through. The main issue with Agent.BTZ is that it replicates itself and changes constantly. As of 2014, there was still traces of the bug in some systems, that’s why their efforts were to contain it instead of destroy it.

The origin of the bug is still unknown, though it is theorized that it may have originated from Russia or China. This bug was written in Assembler (x86-32 bit) and is now thought to be created by a single person. In 2016, the theory changed and it is now believed that it is of Russian origin since Agent.BTZ has similar code to other Russian attacks.

Though there was a great loss of information due to this bug, some good did come of it. After the attack the military banned any removable media devices from being used. They also disabled autorun features on all their computers.

Comments