Electronics manufacturer #Elecrow has released an advisory that their #ThinkNode M9 LoRA mesh node's internal Micro SD cards shipped with Windows malware on them:
https://www.elecrow.com/Thinknode-M9-Security-Advisory-SD-Card-Malware-Risk.html
These are hobbyist devices based on the ESP32 chip, and run specialized firmware like Meshtastic and MeshCore for peer-to-peer communications, and the device's firmware itself is unaffected.
Based on the description and screenshots, it appears to Win32/Virut, an old family of parasitic file infectors that also engage in wormlike behavior by spreading as USB worms via AUTORUN.INF, a mechanism that Microsoft disabled by default in 2009 with the release of Windows 7 (and backported those changes to Windows Vista and Windows XP).
The Virut family is very old, and detection of the malware is quite high by modern security software. While the risk of accidentally running and spreading the malware is low, it is important to follow Elecrow's instructions for remediation if you have an affected device.
