Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Mobile devices may also be used to infect PCs with malware if connected via USB.[1] This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.[2][3] For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled).
| ID | Name | Description |
|---|---|---|
| S0092 | Agent.btz |
Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.[4] |
| S1074 | ANDROMEDA | |
| G1007 | Aoqin Dragon |
Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.[6] |
| G0007 | APT28 |
APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.[7] |
| S0023 | CHOPSTICK |
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.[8][7][9] |
| S0608 | Conficker |
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.[10][11] |
| S0115 | Crimson |
Crimson can spread across systems by infecting removable media.[12] |
| G0012 | Darkhotel |
Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.[13] |
| S0062 | DustySky |
DustySky searches for removable media and duplicates itself onto it.[14] |
| G0046 | FIN7 |
FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.[15] Additionally, FIN7 has used malicious USBs that acted as virtual keyboards to install malware and txt files that decode to PowerShell commands.[16] |
| S0143 | Flame |
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.[17] |
| G0047 | Gamaredon Group |
Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.[18] |
| S0132 | H1N1 |
H1N1 has functionality to copy itself to removable media.[19] |
| S1230 | HIUPAN |
HIUPAN has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory |
| G1014 | LuminousMoth |
LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.[22][23] |
| G0129 | Mustang Panda |
Mustang Panda has used a customized PlugX variant which could spread through USB connections.[24] |
| S0385 | njRAT |
njRAT can be configured to spread via removable drives.[25][26] |
| S0013 | PlugX |
PlugX has copied itself to infected removable drives for propagation to other victim devices.[27] |
| S0650 | QakBot |
QakBot has the ability to use removable drives to spread through compromised networks.[28] |
| S0458 | Ramsay |
Ramsay can spread itself by infecting other portable executable files on removable drives.[29] |
| S1130 | Raspberry Robin |
Raspberry Robin has historically used infected USB media to spread to new victims.[30][31] |
| S0028 | SHIPSHAPE |
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.[32] |
| S0603 | Stuxnet |
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.[33] |
| G0081 | Tropic Trooper |
Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.[34] |
| S0130 | Unknown Logger |
Unknown Logger is capable of spreading to USB devices.[35] |
| S0386 | Ursnif |
Ursnif has copied itself to and infected removable drives for propagation.[36][37] |
| S0452 | USBferry |
USBferry can copy its installer to attached USB storage devices.[34] |
| S0136 | USBStealer |
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.[38] |
| ID | Mitigation | Description |
|---|---|---|
| M1040 | Behavior Prevention on Endpoint |
On Windows 10, enable Attack Surface Reduction (ASR) rules to block unsigned/untrusted executable files (such as .exe, .dll, or .scr) from running from USB removable drives. [39] |
| M1042 | Disable or Remove Feature or Program |
Disable Autorun if it is unnecessary. [40] Disallow or restrict removable media at an organizational policy level if it is not required for business operations. [41] |
| M1034 | Limit Hardware Installation |
Limit the use of USB devices and removable media within a network. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0301 | Removable Media Execution Chain Detection via File and Process Activity | AN0841 |
Execution of files originating from removable media after drive mount, with correlation to file write activity, autorun usage, or lateral spread via staged tools. |