Threat actors from the financially motivated FIN7 cybercrime organization have been operating a physical cyberattack campaign which has been seen at numerous companies throughout the United States. This campaign has threat actors sending malicious USB devices to several companies throughout the nation in hopes for a user to infect their own network. So far there are two (2) possible scenarios of packages with the first claiming to be the US Department of Health and Human Services alongside forged documents, Covid-19 resources, and a LilyGO USB drive. The second variation imitates Amazon gifts, including a counterfeit gift card, gift package wrapping, a thank you letter, and the LilyGO USB. Based on known forensic analyses of the drives, plugging in the USB would initiate a BadUSB attack, registering the drive as a keyboard and executing malicious scripts; executing PowerShell commands to install malware and numerous backdoors on the system. Additionally, security analysts have discovered lateral movement once the attack has been executed successfully and infects surrounding local systems. Furthermore, while attacks are targeting non-government entities there was an attempt on an unnamed United States defense industry company in November. CTIX is continuing to monitor the situation for further developments and will provide updates as necessary.