T1092: Communication Through Removable Media
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.[1] Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
Analyst context for executives and security teams
This technique matters when an organization relies on segmented, isolated, or air-gapped systems for resilience. ATT&CK describes adversaries relaying commands and files between already compromised hosts using removable media, allowing command-and-control activity to bridge networks that may not have direct Internet connectivity.
Executive priority
Treat this as a control-validation issue for high-value disconnected environments: industrial systems, sensitive research networks, restricted enclaves, and recovery infrastructure. Leaders should ask whether removable media use is governed, logged, and reviewable across Windows, Linux, and macOS systems, and whether incident response plans account for cross-network movement by physical media rather than network traffic alone.
Technical view
For SOC, detection engineering, and IR teams, the key validation point is whether activity can be correlated across hosts when removable media is the transport path. ATT&CK provides no official detection text, but the related detection strategy is DET0090, Cross-host C2 via Removable Media Relay. Teams should focus on evidence of removable media insertion, file staging, file transfer timing, and execution or access patterns on both an Internet-connected compromised host and a disconnected or segmented compromised host.
Likely telemetry
- Removable media insertion, mount, and device identifier events on Linux, macOS, and Windows endpoints
- File creation, modification, deletion, and access events on removable volumes
- Process execution from removable media or processes reading from/writing to removable media
- Endpoint security alerts or audit logs from both connected and disconnected systems
- File metadata useful for correlation, such as timestamps, names, paths, hashes, and volume identifiers
Detection direction
- Validate whether DET0090-style cross-host correlation is possible rather than relying only on single-host alerts.
- Tune for sequences where similar files, commands, archives, or staging patterns appear on removable media and then on another host within a plausible transfer window.
- Account for benign removable media workflows, such as approved administrative transfer, patching, backup, or data export processes, to reduce false positives.
- Prioritize monitoring on systems that are intentionally disconnected or segmented, because ordinary network C2 detections may not observe this behavior.
- Review whether endpoint logging persists when systems are offline and whether logs are collected after reconnection or through offline IR procedures.
Mitigation priorities
- Start with policy and operating system configuration controls for removable media use, aligned to M1028 Operating System Configuration.
- Disable or remove unnecessary features or programs that enable unneeded removable media functionality where business operations allow, aligned to M1042 Disable or Remove Feature or Program.
- Define approved removable media workflows, ownership, and audit requirements for sensitive or segmented environments.
- Harden endpoints so removable media activity is logged and reviewable across Windows, Linux, and macOS where those platforms are in scope.
- Ensure incident response playbooks include collection and preservation of removable media artifacts, host logs, and cross-host timeline evidence.
Analyst notes and limits
ATT&CK links this technique to APT28 and to CHOPSTICK and USBStealer software, with USBStealer described as malware used to extract information from air-gapped networks. These relationships support using the technique as a planning case for removable-media relay risk, not as evidence of current activity in any specific environment.
The ATT&CK object does not provide official detection guidance. Local conclusions require environment-specific evidence about removable media policy, endpoint logging, isolated-network operations, and whether the related platforms are present.
Communication Through Removable Media
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.[1] Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
S0023: CHOPSTICK
CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. [1] [2] [3] [4] It is tracked separately from the X-Agent for Android.
S0136: USBStealer
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. [1] [2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | cc6fd45c6b53… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
ESET Sednit USBStealer 2014
Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
Open source URL -
[2]
mitre-attack T1092Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.