The Agent.BTZ worm is a DLL file, written in assembler (x86-32 bit).[4] It spreads by creating an AUTORUN.INF file to the root of each drive with the DLL file.[5] It has the ability "to scan computers for data, open backdoors, and send through those backdoors to a remote command and control server."[3]
In 2008, at a US military base in the Middle East, a USB flash drive infected with Agent.BTZ was inserted into a laptop attached to United States Central Command. From there it spread undetected to other systems, both classified and unclassified.[6] In order to try and stop the spread of the worm, the Pentagon banned USB drives and removable media devices. They also disabled the Windows autorun feature on their computers.[3] The Pentagon spent nearly 14 months cleaning the worm from military networks.[3]
Chinese hackers were thought to be behind the attack because they had used the same code that made up Agent.BTZ in previous attacks.[7] According to an article in The Economist, "it is not clear that agent.btz was designed specifically to target military networks, or indeed that it comes from either Russia or China."[8] An article in the Los Angeles Times reported that US defense officials described the malicious software as "apparently designed specifically to target military networks." It's "thought to be from inside Russia", although it was not clear "whether the destructive program was created by an individual hacker or whether the Russian government may have had some involvement."[9]
In 2010, American journalist Noah Shachtman wrote an article to investigate the theory that the worm was written by a single hacker.[3] Later analyses by Kaspersky Lab found relations to other spyware, including Red October, Turla, and Flame.[10]
In December 2016, the United States FBI and DHS issued a Joint Analysis Report which included attribution of Agent.BTZ to one or more "Russian civilian and military intelligence Services (RIS)."[11]
