Skip to content

T1025 Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Some adversaries may also use Automated Collection on removable media.

Item Value
ID T1025
Sub-techniques
Tactics TA0009
Platforms Linux, Windows, macOS
Version 1.2
Created 31 May 2017
Last Modified 15 October 2021

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed can find and collect data from removable media devices.1718
G0007 APT28 An APT28 backdoor may collect the entire contents of an inserted USB device.28
S0456 Aria-body Aria-body has the ability to collect data from USB devices.23
S0128 BADNEWS BADNEWS copies files with certain extensions from USB devices to
a predefined directory.12
S0050 CosmicDuke CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.5
S0115 Crimson Crimson contains a module to collect data from removable drives.1011
S0538 Crutch Crutch can monitor removable drives and exfiltrate files matching a given extension list.6
S0569 Explosive Explosive can scan all .exe files located in the USB drive.9
S0036 FLASHFLOOD FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.7
S1044 FunnyDream The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.19
G0047 Gamaredon Group A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.2627
S0237 GravityRAT GravityRAT steals files based on an extension list if a USB drive is connected to the system.13
S0260 InvisiMole InvisiMole can collect jpeg files from connected MTP devices.14
S0409 Machete Machete can find, encrypt, and upload files from fixed and removable drives.12
S0644 ObliqueRAT ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.16
S0113 Prikormka Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.8
S0458 Ramsay Ramsay can collect data from removable media and stage it for exfiltration.22
S0125 Remsec Remsec has a package that collects documents from any inserted USB sticks.4
S0090 Rover Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.3
S0467 TajMahal TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.15
G0010 Turla Turla RPC backdoors can collect files from USB thumb drives.2425
S0136 USBStealer Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.2021

Mitigations

ID Mitigation Description
M1057 Data Loss Prevention Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Access

References

  1. The Cylance Threat Research Team. (2017, March 22). El Machete’s Malware Attacks Cut Through LATAM. Retrieved September 13, 2019. ↩

  2. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019. ↩

  3. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016. ↩

  4. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  5. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014. ↩

  6. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020. ↩

  7. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015. ↩

  8. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016. ↩

  9. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021. ↩

  10. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. ↩

  11. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. ↩

  12. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. ↩

  13. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018. ↩

  14. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. ↩

  15. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019. ↩

  16. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021. ↩

  17. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  18. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022. ↩

  19. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. ↩

  20. Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017. ↩

  21. Kaspersky Lab’s Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015. ↩

  22. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. ↩

  23. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020. ↩

  24. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. ↩

  25. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019. ↩

  26. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017. ↩

  27. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020. ↩

  28. Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015. ↩