Honestly, this type of paranoia sounds more like someone on the brink of a breakdown. Can you imagine spending years working on this and still having no 'data' about it? If its infecting stuff from this USB drive, just post the contents of the drive for analysis.
Of course, no recording of HF audio communication channels, no USB drive "ROM" dump, no hard drive controller ROM dump, no BIOS dump, no PCI card BIOS dump, no USB analyzer data, no really infected file. The excuse he uses is "the files become clean when I put them on a CD!".
Hard to take him seriously.
Also read https://news.ycombinator.com/item?id=6647467 for a second opinion.
Recurring themes among those are "they've replaced my possessions/tools/utensils/cloths with ones that look identical but allows them to control/monitor me, and they change them back when I try to show anyone". And to them, it all makes perfect sense.
Again, not saying such malware does not exist - I suspect something similar does (though maybe not as widely cross platform). However, I think that this is an account of a serious PEBKAC problem, rather than malware.
The possibility that compromised machines communicate via audio is interesting in its own right, but the wording of the title, combined with the opening few paragraphs, allows for the suspicion that the malware is spread to uncompromised hosts via audio, which is of course not happening.
The article as a whole is unsatisfying. It makes the research into this malware seem completely inadequate.
Being able to communicate via ultrasound means that if you have an infection on two computers either side of an airgap in close proximity the theoretically isolated computer can be sent instructions from a C&C server and can send data back at-will.
I'm not commenting on the legitimacy of the story, but either technique in isolation is of limited use, combined however they can be a lot more effective.
And we all know that USB sticks (or, rather their flash chips) can be reprogrammed at will. USBest, I'm looking at you. (See also flashboot.ru, the stuff you can do with these tools is amazing.)
1) Hides a bootloader on the devive that runs at reboot (assuming the BIOS allows it).
2) Pretends to be some kind of device (that most OS's have stock drivers for) that allows it to access main memory. Maybe it pretends to be a USB to firewire bridge (or something similar that gives it DMA).
Assuming a government is the adversary (and we ALL know that the NSA sits on a very comprehensive list of exploits!), then this part is actually the easiest.
And if you don't exactly hit the conditions the malware is supposed to expose itself, you have no way to read out the EEPROM inside the flash controller. The data chips maybe, but the controller chip of a USB stick is an entirely different thing.