Unless I'm missing something, this doesn't rely on something really advanced and low-level like USB drive firmware, but a classic flaw that's existed in Windows

Unless I'm missing something, this doesn't rely on something really advanced and low-level like USB drive firmware, but a classic flaw that's existed in Windows for almost 30 years: It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm. It's just another variant of the classic .jpg.exe scam. Stop hiding files and file extensions and this hole can be easily closed.