[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuVbjjUDuYtpnPyzUsRubXS901xqheDY6Ue1mvsgNuZk":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"10b1a6fb-73eb-4ebf-8c0d-0d8264108dc3","SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs","specter-attack-uses-usb-power-signals-to-leak-data-from-air-gapped-pcs-83858e","Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals.","Researchers have demonstrated a new technique called SPECTER that can exfiltrate data from air-gapped computers by manipulating USB power controls. The malware requires administrator privileges and can encode information through USB power-management operations, observable via smartphone charging states, peripheral activity, or near-field electromagnetic signals.","SPECTER attack uses USB power signals to leak data from air-gapped PCs.","https:\u002F\u002Fhackread.com\u002Fspecter-usb-power-signals-air-gapped-pcs-leak-data\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fspecter-usb-power-signals-air-gapped-pcs-leak-data.jpg","2026-10-24T16:02:19+00:00","2026-10-24T17:00:10.075975+00:00",8,[17,20,23,25],{"name":18,"type":19},"air-gapped systems","technology",{"name":21,"type":22},"Samsung Galaxy S22","product",{"name":24,"type":22},"iPhone 13 Pro",{"name":26,"type":22},"HackRF One","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":53,"vendors":140},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":113,"name":114,"problem":115,"products":116},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[117,124,132],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":119,"url":122,"description":123},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-advanced-threat-defense","ShadowPlex Advanced Threat Defense","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fadvanced-threat-defense\u002F","Deception that detects lateral movement and insider threats early, using AI to place and tune decoys.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":153},"specter-attack-leaks-data-from-air-gapped-pcs-via-usb-power-signals","SPECTER Attack Leaks Data from Air-Gapped PCs via USB Power Signals","The SPECTER attack demonstrates that physical isolation alone is insufficient to protect highly sensitive systems, as adversaries can exploit USB power-management controls to encode and exfiltrate data through covert electromagnetic or charging-state signals. The attack requires administrator-level privileges, meaning a prior compromise of the target system is a prerequisite, highlighting that layered defenses must extend beyond the network perimeter. Air-gapped environments are often assumed to be inherently secure, leading organizations to under-monitor them for internal threats. This matters because classified, industrial, or critical infrastructure environments that rely on air-gapping as a primary security control are now demonstrably vulnerable to a sophisticated, hardware-level side-channel attack.",[146,147,148,149,150,151,152],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1200: Hardware Additions","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"MITRE ATT&CK T1200: Hardware Additions":156,"CIS Control 6: Access Control Management":157,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":158,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":159,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":160},"NIS2 requires operators of essential services to implement incident handling and risk-reduction measures that address physical and logical security of critical systems, including protection against covert side-channel exfiltration threats.","Timely identification and remediation of software and configuration weaknesses—including insecure USB power-management defaults—would limit the exploitable conditions SPECTER depends on.","SPECTER abuses physical hardware interfaces (USB power controls) as a covert data exfiltration channel, which aligns with adversary techniques targeting physical device interactions on isolated systems.","SPECTER requires administrator privileges to execute; enforcing least-privilege access on air-gapped machines would prevent the malware from gaining the rights needed to manipulate USB power controls.","Maintaining awareness of emerging covert-channel attack techniques like SPECTER and applying mitigating controls is a core obligation of technical vulnerability management for sensitive environments.","Hardening USB power-management settings and disabling unnecessary USB functionality on air-gapped systems would directly reduce the attack surface exploited by SPECTER.","Restricting administrator-level access on air-gapped systems through strong identity and access controls would deny attackers the elevated privileges required to deploy SPECTER malware."]