--- id: CP-084 slug: booby-trapped-cables-hid-keyboard-emulation lang: en title: Booby-trapped cables and fake keyboard devices description: A USB cable or drive can pose as a keyboard and type commands on your behalf. Here is how to protect yourself. canonical_url: https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/ markdown_url: https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Booby-trapped cables and fake keyboard devices", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-051 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/ fr: https://startbrain.io/cyberpedia/fr/articles/cables-pieges-omg-rubber-ducky/ de: https://startbrain.io/cyberpedia/de/articles/praeparierte-kabel-omg-rubber-ducky/ es: https://startbrain.io/cyberpedia/es/articles/cables-trampa-omg-rubber-ducky/ sources: - "n": 1 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 2 title: Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1091/ accessed: "2026-11-03" - "n": 3 title: FIN7, GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest, Group G0046 | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/groups/G0046/ accessed: "2026-11-03" - "n": 4 title: "Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1059/001/ accessed: "2026-11-03" - "n": 5 title: Using Caution with USB Drives | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/using-caution-usb-drives published: "2021-02-01" accessed: "2026-11-03" - "n": 6 title: Kernel DMA Protection publisher: Microsoft url: https://learn.microsoft.com/en-us/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt accessed: "2026-11-03" - "n": 7 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" --- # Booby-trapped cables and fake keyboard devices A USB cable or drive can look like an ordinary accessory and behave like a keyboard. The computer takes it for an input device and accepts what it "types", without the person at the screen having pressed a single key. MITRE, which catalogues attack techniques, classes this method among hardware additions: accessories or devices physically introduced into a system to gain access. It lists keystroke injection among the capabilities of commercial and open-source products [1]. This article explains what this means for an employee. ## In 30 seconds - Where it happens: at your workstation, when an unknown cable, drive or accessory is plugged into the computer, including an object received by post [3]. - What the attacker wants: to make the machine run commands, for example to download malware [3]. - The reflex: plug in only hardware supplied or approved by the company, and hand any unknown object to IT. - If it has already happened: unplug it, touch nothing else and tell IT without delay (common-sense advice, which the sources cited here do not give). ## Straight answers ### Can a cable really type for me? Yes. The sources cited here describe malicious USB drives that act as virtual keyboards, and keystroke injection as a capability of commercial and open-source products, used notably by offensive audit teams [1][3]. The names of common products in this field do not appear in the sources cited here, except the Bash Bunny, used by the DarkVishnya group [1]. ### Does antivirus stop it? The sources cited here do not say. They recommend not plugging in an unknown drive, turning off autorun and keeping security software up to date [5]. MITRE, for its part, gives a basic measure: blocking unknown devices and accessories through the workstation's security configuration [1]. ### Why is an object received by mail dangerous? Because the attacker does not need to enter the premises. MITRE reports that FIN7 actors mailed USB drives to potential victims [3]. CISA adds that attackers have infected objects during manufacturing, such as digital photo frames or USB drives [5]. ### What should I do with a drive found on the ground? Do not plug it in, even to see its contents or find its owner. CISA asks that it be handed to the right people: the site's security staff or the organisation's IT department [5]. ## Inside the attacker's head The attacker is looking for initial access. For MITRE, a hardware addition is richer than a simple storage drive: it gives the machine new functions that can then be misused [1]. Keystroke injection is one of them [1]. The attacker also needs a reason for the object to be plugged in. CISA describes attackers who pose as a new employee, a repairer or a researcher, presenting credentials [7]. The entry cost is low for some related attacks. Microsoft describes direct memory access attacks that often take a few minutes, with cheap, commercially sold hardware and software, without taking the device apart. An attacker can plug in a USB-type device during the owner's break and leave with the machine's secrets [6]. ## What you see on screen The sources cited here do not describe the victim's screen in general terms. Only one detail is documented: FIN7 used malicious USB drives to open the Run dialog box with the Windows + R key combination, then launched a command prompt [3]. A window that opens by itself just after something is plugged in is therefore a signal to take seriously. The sources do not say whether the attack leaves a visible trace in every case, or how long it lasts. A lack of any sign on screen therefore proves nothing. Security teams rely on other signs: MITRE describes detecting a new device recognised by Windows, followed shortly after by processes launched from the same session and possible keystroke injection [1]. ## Under the hood The principle fits in one sentence: the device presents itself to the computer as a keyboard, and the computer obeys its keystrokes. The sources cited here confirm this for FIN7, some of whose USB drives acted as virtual keyboards [3]. They do not detail the technical protocol or the typing speed. Once the keys are sent, what follows is conventional. FIN7 used these drives to launch PowerShell, then download and run malware from the attacker's server [3]. PowerShell is a command environment built into Windows, which attackers can use to discover information and run code [4]. The charging cable case is similar. MITRE notes that mobile devices and, in some cases, USB charging cables can be used to infect a computer [2]. This mention concerns spread through removable media, not keystroke input. On the defence side, two measures stand out in the sources. The first is to block unknown devices and accessories through the security configuration [1]. The second applies only to direct memory access devices (Thunderbolt, USB4): by default, Windows can prevent those with incompatible drivers from starting until an authorised user has signed in or unlocked the screen, and an administrator can change this behaviour [6]. This protection does not cover FireWire, PCMCIA, CardBus or ExpressCard [6]. ## Case files ### FIN7 and the mailed USB drives FIN7 is a financially motivated criminal group active since 2013. Since 2020, it has turned to big game hunting, using the REvil ransomware and its own service, Darkside [3]. According to MITRE, FIN7 actors mailed USB drives to potential victims. They contained malware that installs several backdoors, sometimes in preparation for ransomware operations [3]. The group also used drives that behaved like virtual keyboards to install malware, as well as text files that decode into PowerShell commands [3]. In detail, these drives sent Windows + R to open the Run box, then launched a command prompt [3]. Others emulated keystrokes to start PowerShell, then download and run a program from the attacker's server [3]. MITRE points to press articles from January 2022, including one dated 7 January 2022 titled "FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware" [3]. The sources cited here describe neither the packaging of the shipments nor their disguise as a gift or official mail. ## Sources 1. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026) 3. MITRE ATT&CK, "FIN7, GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest, Group G0046 | MITRE ATT&CK®". https://attack.mitre.org/groups/G0046/ (accessed 3 November 2026) 4. MITRE ATT&CK, "Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1059/001/ (accessed 3 November 2026) 5. CISA, "Using Caution with USB Drives | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/using-caution-usb-drives (accessed 3 November 2026) 6. Microsoft, "Kernel DMA Protection". https://learn.microsoft.com/en-us/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt (accessed 3 November 2026) 7. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/booby-trapped-cables-hid-keyboard-emulation/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.