[dreadlordbone]

Both tools are "stick infected USB into air gapped device"

[stavros]

How do they get these USB sticks to execute code, though?

[gruez]

From the linked ESET blog post:

>It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm.

[sampullman]

Presumably by taking advantage of an exploit on the host's USB driver.