An APT hacking group known as GoldenJackal has successfully breached air-gapped government systems in Europe using two custom toolsets to steal sensitive data, like emails, encryption keys, images, archives, and documents. [...]
It was just USBs and hoping someone is dumb enough to plug it in. Then plug it back into a connected PC so it can broadcast.
Incredibly simple and low tech, but this shit constantly happens. Just scattering USBs in parking lots still works surprisingly often, and may very well be how this one was introduced into the building to begin with.