Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Some adversaries may also use Automated Collection on removable media.
|Linux, Windows, macOS
|31 May 2017
|15 October 2021
|AppleSeed can find and collect data from removable media devices.
|An APT28 backdoor may collect the entire contents of an inserted USB device.
|Aria-body has the ability to collect data from USB devices.
|BADNEWS copies files with certain extensions from USB devices to
|a predefined directory.
|CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.
|Crimson contains a module to collect data from removable drives.
|Crutch can monitor removable drives and exfiltrate files matching a given extension list.
|Explosive can scan all .exe files located in the USB drive.
|FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.
|The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.
|A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.
|GravityRAT steals files based on an extension list if a USB drive is connected to the system.
|InvisiMole can collect jpeg files from connected MTP devices.
|Machete can find, encrypt, and upload files from fixed and removable drives.
|ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.
|Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.
|Ramsay can collect data from removable media and stage it for exfiltration.
|Remsec has a package that collects documents from any inserted USB sticks.
|Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.
|TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.
|Turla RPC backdoors can collect files from USB thumb drives.
|Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.
|Data Loss Prevention
|Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.