Not just that. You can blame USB but the question is still how the malware got to run on the target system. Did the user double click on the malware? Did it try

Not just that. You can blame USB but the question is still how the malware got to run on the target system. Did the user double click on the malware? Did it try to exploit Explorer trying to preview a file? Did it modify the USB stick's firmware such that it sends commands to the computer that exploit the Windows USB storage driver? Something else? So the interesting TLDR, to me, is this: > [The malware on the infected computer] finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, [...]. We also believe that the component uses a folder icon, to entice the user to [click on] it when the USB drive is inserted in an air-gapped system So the attack vector is "using a transfer medium where data can be replaced with code and the usual procedure [in this case: opening the usual folder] will cause the code to run"