Threat intelligence / Technique

Communication Through Removable Media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

6 recorded

Relationships

mapped-to

from USB Memory Attacks

Technique

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Operating System Configuration

Mitigation

uses

from APT28

Group

uses

Malware

uses

from USBStealer

Malware

2 external

References

mitre-attack

T1092

ESET Sednit USBStealer 2014

http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/