T1052.001: Exfiltration over USB
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Security context for executives and security teams
Exfiltration over USB matters because it bypasses many network-centric controls. For executives and security leaders, the key risk is not just data leaving on a removable drive; it is loss of visibility in environments where USB media is allowed, poorly logged, or used to bridge disconnected systems such as air-gapped networks.
Executive priority
Prioritize this where sensitive data, regulated records, intellectual property, or operational systems are accessible from Linux, Windows, or macOS endpoints that permit removable media. Leadership should ask whether USB use is business-justified, technically controlled, logged, and auditable. This technique is especially material for incident response and compliance evidence because the official ATT&CK object provides no native detection guidance, so local telemetry and policy enforcement determine whether the organization can prove or investigate suspected data movement.
Technical view
SOC and IR teams should validate coverage for removable device insertion, hardware installation or driver activity, file movement to mounted USB storage, and DLP or endpoint-control events. The related ATT&CK detection strategy is DET0220, Detection of USB-Based Data Exfiltration, and mitigations include limiting hardware installation, disabling or removing unnecessary features, and Data Loss Prevention. Because this is a sub-technique of Exfiltration Over Physical Medium, detections should distinguish routine authorized USB use from unusual copy volume, sensitive file types, atypical users, off-hours activity, or use on systems expected to be isolated.
Likely telemetry
- Endpoint removable media insertion and removal events
- USB storage mount, volume, and device identifier records
- Hardware installation, driver installation, or device-control policy logs
- File creation, modification, copy, or archive activity on removable media paths
- DLP alerts for sensitive data movement to removable storage
Detection direction
- Map existing controls to DET0220 and test whether USB-based file movement is visible on Linux, Windows, and macOS where applicable.
- Tune detections around data movement context: volume copied, sensitivity of files, destination removable media, user role, host criticality, and time of activity.
- Review false positives from legitimate administrative, backup, engineering, or operational workflows that require USB media.
- Look for blind spots on air-gapped or intermittently connected systems where logs may not centralize quickly or at all.
- Correlate USB activity with DLP and endpoint-control events rather than relying on network exfiltration monitoring, which may see nothing.
Mitigation priorities
- Start by defining which users, systems, and business processes are allowed to use USB storage.
- Apply M1034 Limit Hardware Installation through hardware usage policies, USB restrictions, and controls on unauthorized peripheral use.
- Use M1042 Disable or Remove Feature or Program where removable storage capabilities are unnecessary for the system role.
- Apply M1057 Data Loss Prevention to classify, monitor, and control movement of sensitive data to removable media.
- Maintain exception handling and audit evidence so approved USB use remains reviewable during investigations or compliance assessments.
Additional notes and limits
ATT&CK relationships show use of this technique by Tropic Trooper and Mustang Panda, and by Windows-associated software including SPACESHIP, Agent.btz, Remsec, USBStealer, and Machete. These relationships support threat-informed prioritization, especially for organizations with sensitive or isolated environments, but they do not by themselves indicate current targeting or exposure.
The official ATT&CK detection field is not provided for this object. Defensive conclusions therefore depend on the supplied mitigation relationships, the DET0220 detection-strategy relationship, and local evidence of endpoint logging, DLP, device control, and USB policy enforcement.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Exfiltration over USB
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1052 | Exfiltration Over Physical Medium | This object subtechnique of Exfiltration Over Physical Medium. |
Groups, software, and campaigns
G0081: Tropic Trooper
Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.[1][2][3]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
S0035: SPACESHIP
S0125: Remsec
S0136: USBStealer
USBStealer is malware that has been used by APT28 since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with ADVSTORESHELL. [1] [2]
S0092: Agent.btz
S0409: Machete
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 9b064dc335c1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FireEye APT30
FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
Open source URL - [2]Kaspersky ProjectSauron Full Report
Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
Open source URL - [3]ESET Sednit USBStealer 2014
Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
- [4]Microsoft Disable Autorun
Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
Open source URL - [5]TechNet Removable Media Control
Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
Open source URL - [6]TrendMicro Tropic Trooper May 2020
Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
Open source URL - [7]Avira Mustang Panda January 2020
Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
Open source URL - [8]Securelist Agent.btz
Gostev, A.. (2014, March 12). Agent.btz: a Source of Inspiration?. Retrieved April 8, 2016.
Open source URL - [9]ESET Machete July 2019
ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
Open source URL - [10]Securelist Machete Aug 2014
Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.
Open source URL - [11]mitre-attackT1052.001Open source URL
- [12]mitre-attackT1052.001Open source URL
- [13]mitre-attackT1052.001Open source URL
- [14]FireEye APT30
FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.
Open source URL - [15]Kaspersky ProjectSauron Full Report
Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
Open source URL - [16]ESET Sednit USBStealer 2014
Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
- [17]Microsoft Disable Autorun
Microsoft. (n.d.). How to disable the Autorun functionality in Windows. Retrieved April 20, 2016.
Open source URL - [18]TechNet Removable Media Control
Microsoft. (2007, August 31). https://technet.microsoft.com/en-us/library/cc771759(v=ws.10).aspx. Retrieved April 20, 2016.
Open source URL - [19]TrendMicro Tropic Trooper May 2020
Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
Open source URL - [20]Avira Mustang Panda January 2020
Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
Open source URL - [21]Securelist Agent.btz
Gostev, A.. (2014, March 12). Agent.btz: a Source of Inspiration?. Retrieved April 8, 2016.
Open source URL - [22]ESET Machete July 2019
ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
Open source URL - [23]Securelist Machete Aug 2014
Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.