Japan’s Defence Forces Used USB Drives Carrying China-Linked Virus

Japan’s Self-Defense Forces used USB drives infected with malware linked to a Chinese hacking group on computers handling sensitive military information for nearly a year, raising concerns over possible exposure of classified data and highlighting weaknesses in the country’s defence cybersecurity.

The compromised USB drives were used by the Ground Self-Defense Force (GSDF) on systems connected to Japan’s Defence Information Infrastructure, including computers associated with closed networks designed to protect sensitive military information.

The malware was discovered in February 2025 after a GSDF member at the Middle Army headquarters in Itami, near Osaka, noticed a computer slowing down. An inspection of a USB drive connected to the machine found a virus, prompting an internal investigation that identified six infected USB devices.

More than 50 of roughly 480 computers examined had been connected to the infected drives, Nikkei reported. Nearly half of those computers were linked to closed systems used for highly sensitive functions, including unit command and control operations.

The incident exposed gaps in Japan’s cybersecurity safeguards. The GSDF normally employs multiple checks, including virus scans when storage devices are acquired and during use, but the infected USB drives were not included in some security scans, allowing the malware to remain undetected for months.

According to the investigation, the USB devices were counterfeit products manufactured in China. Instead of genuine high-capacity memory chips, the drives contained cheaper microSD cards, and devices advertised as having 1 terabyte of storage capacity actually held about 240 gigabytes.

The drives were distributed to the regional headquarters in March 2024 after disaster relief operations following an earthquake on Japan’s Noto Peninsula in January that year. The records did not show how the devices had been procured.

The virus found on the drives has been identified by a U.S. cybersecurity company as malware previously used by a China-linked hacking group. The newspaper said investigators had not publicly established who planted the malware or whether the attack was deliberate.

The discovery comes as Japan faces growing concerns over cyberattacks targeting defence and advanced technology networks. Japanese authorities have previously accused the China-linked group MirrorFace of conducting campaigns aimed at stealing sensitive information related to national security and technology sectors.

Japan’s defence networks have also been the target of previous suspected Chinese cyber operations. In 2023, reports said Chinese military hackers had compromised sensitive Japanese defence networks, prompting Tokyo to strengthen cybersecurity cooperation with allies.

The GSDF acknowledged that a USB drive acquired by the force was found to contain malware but did not provide further details on the scope of possible information exposure, Nikkei reported.

Cybersecurity experts have long warned that USB devices remain a potential route for malware infections, particularly in organisations that use removable storage to transfer information between isolated networks.

The incident is likely to intensify scrutiny of Japan’s defence procurement and supply-chain security practices as Tokyo expands military cooperation with the United States and other partners amid rising regional tensions.

Stay ahead of the stories shaping our world. Subscribe to Impact Newswire for timely, curated insights on global tech, business, and innovation all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Pitch it to us at info@impactnews-wire.com and reach the right audience worldwide