LuminousMothG1014 ↗
Has used malicious DLLs to spread malware to connected removable USB drives on infected machines.12
tfMITRE ATT&CK technique
Replication Through Removable Media T1091
- Tactics
- Initial Access, Lateral Movement
- Platform
- Windows
- Version
- 1.3
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributor
- Joas Antonio dos Santos, @C0d3Cr4zy
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 77% of ATT&CK techniques have fewer threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.20
Tools & malwareTop 17%
Tools & malware83rd percentile · 82% of ATT&CK techniques have fewer tools implementing them.5
Detection rules64th pct
Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.