BadUSB Attacks in OT: CVE-2025-4371 and ICS Security

BadUSB attacks are a growing threat to operational technology and industrial control system environments.

BadUSB is an attack technique where every USB has a microcontroller with firmware that tells the host system what type of device it is.

In these attacks, compromised USB devices can behave like a trusted keyboard and inject malicious commands without using any malware.

CVE-2025-4371, also known as BadCam, expands this risk: an attacker with remote code execution can switch on a connected Lenovo webcam and turn it into a persistent BadUSB device without physical access.

Organizations that rely on removable media, contractor laptops, legacy systems, or poorly monitored OT assets should treat USB device control and firmware integrity as priority security measures.

How Does a BadUSB Attack Work?

Here’s how BadUSB attacks work:

• An attacker reprograms the firmware so the device starts identifying itself as a keyboard instead of a flash drive.
• The moment it’s plugged in, the OS trusts it like any other keyboard and starts processing its input.
• The device then types out a pre-programmed sequence of commands at machine speed – faster than any human could react – opens a command prompt, downloads a payload, and closes everything before most people even realize something happened.

The whole sequence can be completed in under 30 seconds without any files to scan, any executable to flag, and with no antivirus alert.

What Is CVE-2025-4371 (BadCam), and Why Does It Matter?

This is what makes the current threat more serious than it was even two years ago.

Eclypsium researchers found that certain Lenovo webcams – specifically the 510 FHD and Performance FHD models – run Linux internally and have no firmware signature validation.

Because of that, an attacker who gains remote code access on a host machine can silently reflash the webcam’s firmware and turn it into a BadUSB device, all without physically touching the camera. Presented at DEF CON 33 in August 2025, this is the first documented case of a USB peripheral being remotely weaponized from a device that was already connected and never intended to be malicious.

The scarier part: the compromise survives a full OS reinstall.

Once the webcam firmware is reflashed, wiping the host and starting fresh doesn’t help – the camera is still infected and can re-infect whatever machine it gets plugged into next.

In an OT environment where webcams and peripherals move between workstations, that’s a serious persistence mechanism. CVSS 6.8. Lenovo patched this with firmware version 4.8.0 – update if you have these cameras in your environment.

Why OT environments are especially at risk

USB drives and contractor laptops account for nearly 27% of OT incidents, and removable media was the initial infection vector in 52% of all ICS-related incidents analyzed by major OT security researchers – more than phishing and network-based attacks combined.

The structure of industrial environments makes this worse:

• Legacy systems everywhere – Engineering workstations running Windows XP, Windows 7, or unpatched Windows 10 are common on plant floors. They have no modern endpoint protection and can’t be patched without risking production continuity. They’re perfect targets.
• USB is often the only data transfer option – Air-gapped or heavily segmented OT networks leave engineers with few choices for moving firmware updates, config files, and data. USB becomes a habit. This regular part of the job expands the attack surface.
• Contractors bypass your controls – Maintenance technicians and contractors routinely plug their own laptops and USB devices into historian servers, DCS consoles, and engineering workstations – with broad access and endpoints entirely outside your control.
• The Purdue model doesn’t stop physical threats – IT/OT segmentation contains network-borne threats. A USB drive carried across that boundary by an authorized employee collapses the architecture entirely. The attacker doesn’t breach your perimeter – your own people bring it in.
• Fewer than 10% of OT networks have proper monitoring – Per Dragos and Bitsight’s 2026 research, most OT environments are flying blind. 30% of 2025 incident response cases were only initiated because a human operator felt something seemed wrong. USB-attacks operate quietly gather intelligence for weeks before doing anything visible.

How Attacks Are Being Carried Out in 2026

Modern campaigns targeting ICS operators are operationally planned.

Threat actors conduct physical reconnaissance of facilities, identify personnel who routinely handle removable media – maintenance technicians, I&E engineers, contractors – and tailor the bait to fit.

A drive labeled “SCADA Firmware Update – Rev 4.2.1” left near an engineering workstation is going to get picked up and plugged in because it looks like legitimate work.

In 2026, attackers have combined planted USB devices with fake calls to IT helpdesks.

One attacker may pose as a vendor while another leaves the device onsite.

FIN7 has also mailed BadUSB devices disguised as Amazon gift cards and HHS communications to defense and transportation companies, using them to deploy ransomware.

The required hardware costs less than $100 and is openly sold as penetration-testing equipment.

Why Is BadUSB a Critical OT Risk?

OT environments often rely on legacy systems that cannot be easily patched, routine USB-based data transfers, contractors using unmanaged endpoints, and limited monitoring below the Windows layer. These systems and work patterns create structural weaknesses that BadUSB attacks can exploit. ProArch’s OT managed services for manufacturing can help industrial organizations improve visibility into assets, access pathways, and operational cyber risk.

Key risks include:

• Limited endpoint detection: EDR tools may detect suspicious processes or file activity, but they are not designed to recognize malicious keyboard input arriving at machine speed from a newly connected device.
• Unsafe control logic and physical impact: If a BadUSB device reaches a PLC programming workstation, it may alter control logic and send unsafe instructions to physical equipment.
• Disabled safety safeguards: A firmware-level compromise that reaches Safety Instrumented Systems could disable critical safeguards designed to prevent catastrophic industrial failures.
• Persistent remote compromise: CVE-2025-4371 allows an attacker who already controls a machine connected to a vulnerable Lenovo webcam to turn it into a persistent BadUSB device without physical access.
• Reinfection across workstations: The compromise can survive an operating system reinstall and spread when the camera is connected to another workstation, so wiping the original host may not remove the threat.
• Compliance gaps: IEC 62443, NIST SP 800-82, NERC CIP, and NIS2 expect evidence of implemented controls, audit logs, and tested incident response procedures. A written USB policy alone may not demonstrate compliance.

What Can BadUSB Do Inside an OT Environment?

• Deploy reconnaissance tools to map network topology, identify PLC and DCS endpoints, and steal configuration files.
• Inject malicious ladder logic or function block diagrams by automating actions within engineering software on a compromised workstation.
• Maintain persistent access through scheduled tasks, startup scripts, or firmware changes on connected devices.
• Move laterally from engineering workstations into Level 2 OT systems by exploiting trusted connections between networked hosts.
• Send unsafe commands to motors, valves, actuators, and other physical equipment if firmware-level access is gained, potentially causing equipment damage.

How Can Organizations Protect OT Environments from BadUSB Attacks?

• Patch CVE-2025-4371 if you have affected Lenovo webcams – Lenovo 510 FHD and Performance FHD models are affected. Update to firmware version 4.8.0 via Lenovo’s support site (LEN-194466). If you can’t patch immediately, audit which machines these cameras are attached to and treat those endpoints at elevated risk.
• Implement USB device whitelisting on OT assets – Define a positive list of approved USB devices by hardware ID and serial number. Nothing on the list cannot be connected. Make sure whatever tool you use is validated for OT environments – enterprise IT USB blockers often conflict with proprietary industrial software.
• Set up a USB inspection workstation – Any USB device – including contractor devices – should be scanned on a dedicated, air-gapped inspection workstation before it touches any OT asset. Contractors should be onboarded to this requirement before stepping onto the floor.
• Baseline and verify firmware on OT devices – Establish a firmware hash baseline for every OT device in scope. After any maintenance window that involves removable media or contractor access, verify firmware hasn’t changed.
• Log every USB connection event and get it into your SIEM – Every removable media connection on an OT asset should generate an alert. Windows Event Forwarding can track USB enumeration events (PnPDeviceConnected) – start there if you don’t have device control software in place yet. You can’t respond to what you can’t see.
• Run a tabletop exercise for this scenario – Most OT security teams have never walked through the response process for a Bad USB or firmware-level compromise. Understanding your detection and response gaps before an incident is far better than discovering them during one. Include the contractor access scenario specifically – that’s the most realistic entry path.

Not sure whether your OT environment can detect or contain a BadUSB attack? ProArch can help you assess removable media controls, firmware exposure, contractor access, and incident response readiness—so you can identify gaps before they affect operations. Schedule an OT security assessment.