T1091: Replication Through Removable Media
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Mobile devices may also be used to infect PCs with malware if connected via USB.[1] This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.[2][3] For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).
Analyst context for executives and security teams
Replication Through Removable Media matters because it gives adversaries a path into or across Windows environments that may not depend on email, internet access, or normal network connectivity. USB drives, external media, smartphones, and even charging cables can become a bridge between trusted and untrusted systems, including disconnected or air-gapped networks. For leaders, the business issue is not just malware on a USB device; it is whether operational, classified, lab, manufacturing, or recovery environments have defensible controls and evidence around removable media use.
Executive priority
Treat this as a resilience and governance control area, especially where Windows systems interact with sensitive operations, third parties, travel workflows, shared workstations, or disconnected networks. Executives should ask whether the organization can prove which removable devices are allowed, where Autorun-like behavior is disabled or controlled, whether endpoint behavior prevention is active, and whether incident responders can reconstruct file and process activity after media insertion. The number of ATT&CK relationships to threat groups and malware families indicates this is a well-represented behavior in ATT&CK reporting, but local risk should be based on actual removable media use, critical asset exposure, and telemetry maturity.
Technical view
For SOC, detection engineering, and IR teams, validate coverage around Windows removable media insertion followed by suspicious file creation, file modification on removable drives, renamed executables, and process execution from removable paths. The supplied ATT&CK object has no official detection text, but the related detection strategy DET0301, Removable Media Execution Chain Detection via File and Process Activity, supports focusing on the chain of device connection, file activity, and process activity rather than on device presence alone. Investigations should correlate media events with endpoint process lineage, executable launch paths, user context, and subsequent lateral movement or initial access indicators. Relationship context includes multiple groups and Windows malware families using this technique, so detections should be behavior-based rather than limited to known tool names such as PlugX, Agent.btz, USBStealer, Flame, njRAT, Ursnif, or others listed in ATT&CK relationships.
Likely telemetry
- Windows endpoint device insertion and removable storage events
- File creation, modification, rename, and execution events on removable media paths
- Process creation telemetry with command line, parent process, user, working directory, and image path
- Endpoint security alerts for suspicious process behavior or execution from external media
- Autorun or removable media policy configuration evidence
Detection direction
- Validate whether the SOC can correlate removable media insertion with file/process activity, not just alert on USB usage.
- Tune for execution from removable paths, newly written executables or scripts on removable drives, files renamed to resemble legitimate documents or utilities, and unusual parent-child process relationships after media insertion.
- Account for legitimate administrative, engineering, medical, manufacturing, or field-support workflows that may require removable media; use allowlists and business context to reduce false positives.
- Prioritize monitoring on Windows systems connected to sensitive, disconnected, or operationally critical environments where removable media may bridge trust zones.
- Review blind spots where endpoint agents do not log external device events, where mobile devices mount as storage, where charging cables or peripheral devices are not inventoried, or where air-gapped systems lack centralized telemetry.
Mitigation priorities
- First, establish and enforce removable hardware usage policy through M1034 Limit Hardware Installation: restrict unauthorized external drives, peripherals, driver installation, and unapproved hardware use.
- Disable or remove unnecessary features that enable automatic execution or unnecessary removable media interaction, consistent with M1042 Disable or Remove Feature or Program.
- Apply M1040 Behavior Prevention on Endpoint to block or contain suspicious process and file behavior associated with execution from removable media.
- Define exceptions for approved business workflows, and ensure exceptions are documented, time-bound where possible, and auditable.
- For disconnected or high-criticality Windows environments, pair technical restrictions with operational procedures for scanning, handling, and approving removable media before use.
Analyst notes and limits
This technique is mapped to Enterprise ATT&CK T1091 and the Windows platform, with tactics of Initial Access and Lateral Movement. The object describes removable media, modified files on media, user deception through legitimate-looking filenames, Autorun-related execution, and mobile devices connected over USB as possible infection paths. ATT&CK relationships show mitigation coverage from M1034, M1040, and M1042, detection strategy DET0301, and use by multiple groups and software entries. Those relationships support prioritizing behavior-based controls and telemetry validation, but they do not by themselves prove current activity in any specific environment.
MITRE provides no official detection text for this technique in the supplied object. This take is limited to the supplied STIX fields, external references, and relationships, and does not assert active exploitation, customer exposure, or guaranteed detection. Local conclusions require environment-specific evidence: removable media policy, Windows configuration, endpoint telemetry quality, exception handling, and the actual business need for removable devices.
Replication Through Removable Media
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Mobile devices may also be used to infect PCs with malware if connected via USB.[1] This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.[2][3] For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
G1014: LuminousMoth
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.[1][2]
G1007: Aoqin Dragon
Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.[1]
G0012: Darkhotel
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
G0046: FIN7
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0081: Tropic Trooper
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
S0143: Flame
S0028: SHIPSHAPE
S1230: HIUPAN
HIUPAN (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by Mustang Panda and was first observed utilized in 2024. [1][2]
S0013: PlugX
S0130: Unknown Logger
Unknown Logger is a publicly released, free backdoor. Version 1.5 of the backdoor has been used by the actors responsible for the MONSOON campaign. [1]
S0062: DustySky
S0132: H1N1
S0603: Stuxnet
Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]
S1130: Raspberry Robin
Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[1][2][3] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[4] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[5]
S0092: Agent.btz
S0385: njRAT
S0452: USBferry
USBferry is an information stealing malware and has been used by Tropic Trooper in targeted attacks against Taiwanese and Philippine air-gapped military environments. USBferry shares an overlapping codebase with YAHOYAH, though it has several features which makes it a distinct piece of malware.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 82633a9eda74… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Exploiting Smartphone USB
Zhaohui Wang & Angelos Stavrou. (n.d.). Exploiting Smart-Phone USB Connectivity For Fun And Profit. Retrieved May 25, 2022.
Open source URL -
[2]
Windows Malware Infecting Android
Lucian Constantin. (2014, January 23). Windows malware tries to infect Android devices connected to PCs. Retrieved May 25, 2022.
Open source URL -
[3]
iPhone Charging Cable Hack
Zack Whittaker. (2019, August 12). This hacker’s iPhone charging cable can hijack your computer. Retrieved May 25, 2022.
Open source URL -
[4]
mitre-attack T1091Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.