Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Some adversaries may also use Automated Collection on removable media.

ID: T1025
Sub-techniques:  No sub-techniques
Tactic: Collection
Platforms: Linux, Windows, macOS
System Requirements: Privileges to access removable media drive and files
Data Sources: Command: Command Execution, File: File Access
Version: 1.1
Created: 31 May 2017
Last Modified: 24 March 2020

Procedure Examples

ID Name Description
G0007 APT28

An APT28 backdoor may collect the entire contents of an inserted USB device.[1]

S0456 Aria-body

Aria-body has the ability to collect data from USB devices.[2]

S0128 BADNEWS

BADNEWS copies files with certain extensions from USB devices toa predefined directory.[3]

S0050 CosmicDuke

CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.[4]

S0115 Crimson

Crimson contains a module to collect data from removable drives.[5]

S0538 Crutch

Crutch can monitor removable drives and exfiltrate files matching a given extension list.[6]

S0569 Explosive

Explosive can scan all .exe files located in the USB drive.[7]

S0036 FLASHFLOOD

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.[8]

G0047 Gamaredon Group

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.[9][10]

S0237 GravityRAT

GravityRAT steals files based on an extension list if a USB drive is connected to the system.[11]

S0260 InvisiMole

InvisiMole can collect jpeg files from connected MTP devices.[12]

S0409 Machete

Machete can find, encrypt, and upload files from fixed and removable drives.[13][14]

S0113 Prikormka

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.[15]

S0458 Ramsay

Ramsay can collect data from removable media and stage it for exfiltration.[16]

S0125 Remsec

Remsec has a package that collects documents from any inserted USB sticks.[17]

S0090 Rover

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.[18]

S0467 TajMahal

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.[19]

G0010 Turla

Turla RPC backdoors can collect files from USB thumb drives.[20][21]

S0136 USBStealer

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.[22][23]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References