T1052.001: Exfiltration over USB
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Analyst context for executives and security teams
Exfiltration over USB matters because it bypasses many network-centric controls. For executives and security leaders, the key risk is not just data leaving on a removable drive; it is loss of visibility in environments where USB media is allowed, poorly logged, or used to bridge disconnected systems such as air-gapped networks.
Executive priority
Prioritize this where sensitive data, regulated records, intellectual property, or operational systems are accessible from Linux, Windows, or macOS endpoints that permit removable media. Leadership should ask whether USB use is business-justified, technically controlled, logged, and auditable. This technique is especially material for incident response and compliance evidence because the official ATT&CK object provides no native detection guidance, so local telemetry and policy enforcement determine whether the organization can prove or investigate suspected data movement.
Technical view
SOC and IR teams should validate coverage for removable device insertion, hardware installation or driver activity, file movement to mounted USB storage, and DLP or endpoint-control events. The related ATT&CK detection strategy is DET0220, Detection of USB-Based Data Exfiltration, and mitigations include limiting hardware installation, disabling or removing unnecessary features, and Data Loss Prevention. Because this is a sub-technique of Exfiltration Over Physical Medium, detections should distinguish routine authorized USB use from unusual copy volume, sensitive file types, atypical users, off-hours activity, or use on systems expected to be isolated.
Likely telemetry
- Endpoint removable media insertion and removal events
- USB storage mount, volume, and device identifier records
- Hardware installation, driver installation, or device-control policy logs
- File creation, modification, copy, or archive activity on removable media paths
- DLP alerts for sensitive data movement to removable storage
Detection direction
- Map existing controls to DET0220 and test whether USB-based file movement is visible on Linux, Windows, and macOS where applicable.
- Tune detections around data movement context: volume copied, sensitivity of files, destination removable media, user role, host criticality, and time of activity.
- Review false positives from legitimate administrative, backup, engineering, or operational workflows that require USB media.
- Look for blind spots on air-gapped or intermittently connected systems where logs may not centralize quickly or at all.
- Correlate USB activity with DLP and endpoint-control events rather than relying on network exfiltration monitoring, which may see nothing.
Mitigation priorities
- Start by defining which users, systems, and business processes are allowed to use USB storage.
- Apply M1034 Limit Hardware Installation through hardware usage policies, USB restrictions, and controls on unauthorized peripheral use.
- Use M1042 Disable or Remove Feature or Program where removable storage capabilities are unnecessary for the system role.
- Apply M1057 Data Loss Prevention to classify, monitor, and control movement of sensitive data to removable media.
- Maintain exception handling and audit evidence so approved USB use remains reviewable during investigations or compliance assessments.
Analyst notes and limits
ATT&CK relationships show use of this technique by Tropic Trooper and Mustang Panda, and by Windows-associated software including SPACESHIP, Agent.btz, Remsec, USBStealer, and Machete. These relationships support threat-informed prioritization, especially for organizations with sensitive or isolated environments, but they do not by themselves indicate current targeting or exposure.
The official ATT&CK detection field is not provided for this object. Defensive conclusions therefore depend on the supplied mitigation relationships, the DET0220 detection-strategy relationship, and local evidence of endpoint logging, DLP, device control, and USB policy enforcement.
Exfiltration over USB
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1052 | Exfiltration Over Physical Medium | This object subtechnique of Exfiltration Over Physical Medium. |
Groups, software, and campaigns
G0081: Tropic Trooper
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
S0035: SPACESHIP
S0125: Remsec
S0136: USBStealer
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. [1] [2]
S0092: Agent.btz
S0409: Machete
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 9b064dc335c1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T1052.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.