GSDF Member Brings Malware-Infected USB to Headquarters

Jen.Jiji

GSDF Member Brings Malware-Infected USB to Headquarters

First seen 15 Sep 2026, 16:23 UTC • •39.0

Article Content

1 / 3

Browse articles

ThreatCluster •September 15, 2026 at 17:55 UTC

•A malware-infected USB was brought into GSDF headquarters by a service member.
•The USB had been in use since April 2024 for official work related to a natural disaster.
•GSDF prohibits personal devices, raising questions about compliance and security protocols.

Japan's Ground Self-Defense Force (GSDF) reported that a service member brought a malware-infected USB memory stick into its Middle Army headquarters. The GSDF is currently investigating how the USB stick was obtained, as it had been in use since April 2024 for tasks related to the January 2024 Noto Peninsula earthquake. The malware was detected in February 2025, raising concerns about the security protocols surrounding personal devices. The GSDF has strict regulations prohibiting the use of personal USB drives, managing officially procured devices through a registry. The incident highlights potential vulnerabilities in the GSDF's cybersecurity measures and device management practices.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2024-01-01

Noto Peninsula earthquake response begins

GSDF uses USB drives for operational tasks related to the earthquake response.

2024-04-01

USB stick registered for GSDF use

The malware-infected USB stick was officially registered and used by the GSDF headquarters.

2025-02-01

Malware detected on USB stick

GSDF confirmed the presence of malware on the USB stick used since April 2024.

2026-09-15

GSDF reports incident publicly

GSDF announces the malware incident and its inability to determine the USB's origin.

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1091 - Replication Through Removable Media

Organization (2)

Ground Self-Defense Force
Japan's Ground Self-Defense Force

Relationships

Malware related to Ground Self-Defense Force
Malware related to Japan's Ground Self-Defense Force
Malware related to T1091 - Replication Through Removable Media

Following this threat?

Track Ground Self-Defense Force in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical Zero-Day Vulnerability in Cisco Secure Email Gateway Exploited On September 14, 2026, Cisco disclosed a critical SQL injection vulnerability (CVE-2026-76461) in its Secure Email Gateway, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges. This vulnerability arises from insufficient validation in the email parsing logic. Cisco confirmed…