APT28G0007 ↗
Uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.1
tfMITRE ATT&CK technique
Communication Through Removable Media T1092
- Tactic
- Command and Control
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 31 May 2017
- Last modified
- 24 October 2025
Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.[1] Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media. Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 44% of ATT&CK techniques have fewer tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.