How USB-Based Attacks Work and How to Protect Critical Systems

In industrial environments, USB drives are still widely used to transfer files, update software, or install drivers, particularly in air-gapped or isolated networks where direct internet access is restricted or prohibited. While these workflows are essential for continuity and maintenance, they also open the door to one of the most persistent threat vectors in operational technology (OT): removable media malware.

According to the SANS 2024 State of ICS/OT Cybersecurity report, removable media accounted for 20.3% of initial vectors in cyberattacks targeting industrial control systems (ICS). That makes USB drives one of the most common points of entry for malware in OT networks, despite being easy to overlook.

In early 2025, a real-world case demonstrated how these attacks can begin, using nothing more than a downloaded driver and a USB stick.

Case Study: Procolored Printer Driver Malware

In May 2025, Cameron Coward, a journalist and reviewer for Hackster.io, discovered a troubling malware sample while preparing a review for a consumer-grade UV printer: the Procolored V11 Pro DTO. During setup, Coward downloaded the official driver from the manufacturer’s website and noticed unusual behavior on his system after installation.

Upon further investigation with assistance from G DATA researcher Karsten Hahn, the driver package was confirmed to contain malware. Specifically, the Windows installer file included an embedded executable that dropped malicious components onto the system during the installation process.

According to Karsten Hahn’s detailed write-up, the malware used a basic persistence mechanism. The malware originated from the official Procolored support website, where users downloaded driver software. Once downloaded, it was often transferred to a USB stick for installation, especially in offline or semi-isolated environments.

This example demonstrated how easily removable media could become a delivery mechanism. If this installer had been used to set up a printer on an air-gapped engineering workstation or a SCADA terminal, the malware could have silently crossed the isolation barrier.

Why USBs Remain a Threat in Critical Environments

Many ICS/OT networks rely on USB drives for software or firmware updates, driver and diagnostic tool installation, configuration file imports, and manual data collection from field equipment.

In environments without internet access, these files are often downloaded externally and carried into the network via removable media. If a single file is compromised, the malware can bypass network defenses entirely, because airgaps can’t inspect files.

These attacks don’t require sophisticated exploits. They often rely on:

• Executables hidden in trusted installer packages

• Malicious scripts or dropper files triggered during installation

• Human trust in “official” vendor downloads

• A lack of scanning at the physical entry point

How DataStationX Stops USB-Based Malware

To mitigate this risk without disrupting workflows, organizations must inspect every file entering the OT environment before it reaches any critical endpoint.

DataStationX is a file upload station that enforces isolation through purpose-built hardware designed for this exact scenario. It acts as a secure intermediary between USB devices and isolated networks, enforcing advanced inspection, sanitization, and access controls before files are allowed in.

USB Control & Access Lockdown

• Only authorized users can initiate file scans

• All USB interactions are logged

• Devices violating policies can be automatically blocked

Multi-Engine Antivirus Scanning

• Leverages multiple detection engines in parallel

• Flags known threats like the Procolored printer malware before installation

• Detects suspicious executables, embedded droppers, and persistence attempts

Threat Intelligence

• Matches files and behaviors against global malware indicators

• Provides enriched metadata and file reputation scoring

• Detects newly active or rehosted malicious domains

Deep Content Inspection & Sanitization

• Strips suspicious content from files like PDFs, DOCX, and EXEs

• Can block installation files by policy, or allow only whitelisted drivers

• Ensures that even trusted software is behaviorally safe

Airgap-Compatible Operation

• Designed for use in isolated environments

• Functions fully offline when required

• Audit logs can be exported for compliance tracking

By placing DataStationX in front of the air gap, you protect your critical systems from unknown threats, whether the risk comes from a malicious payload or a seemingly safe driver package from a trusted vendor.

Trust Nothing, Scan Everything

The Procolored malware incident highlighted how easily malicious software can travel undetected, particularly through the USB workflows that many OT environments still rely on.

It also reinforced a key reality: airgaps are not security controls; they are network designs. Without inspection, enforcement, and logging at the point of file transfer, malware can slip through unnoticed.

Contact our experts today to discover how DataStationX empowers you to maintain control over your OT/ICS environments and keep them safe.