Threat intelligence / Technique

Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.

25 recorded

Relationships

mitigates

from Data Loss Prevention

Mitigation

uses

Malware

uses

from APT28

Group

uses

Malware

uses

Malware

uses

from CosmicDuke

Malware

uses

Malware

uses

Malware

uses

Malware

uses

from FLASHFLOOD

Malware

uses

from FunnyDream

Malware

uses

from Gamaredon Group

Group

uses

from GravityRAT

Malware

uses

from InvisiMole

Malware

uses

Malware

uses

from MgBot

Malware

uses

from ObliqueRAT

Malware

uses

Group

uses

Malware

uses

Malware

uses

Malware

uses

from Rover

Malware

uses

Malware

uses

from Turla

Group

uses

from USBStealer

Malware

1 external

References

mitre-attack

T1025