Attackers use Replication Through Removable Media to spread malware by copying it onto USB drives or other removable devices and then relying on human handling or autorun-style behaviour. This technique crosses air gaps and internal boundaries. Defenders should restrict removable media, monitor device insertion, and scan content before execution or transfer.
How removable media turns malware into a portable spread mechanism
replication through removable media works because the malware does not need a live network path to move. A copied payload on USB or another removable device can reach a new host through routine human handling, file transfer, or execution on insertion. That makes removable media a reliable bridge across air gaps, segmented environments, and unmanaged endpoints.
The technique is effective when the attacker wants scale and low friction more than stealthy persistence. The removable device becomes the delivery vehicle, while the user or device workflow does the rest: plugging in media, opening files, or allowing device services to mount content automatically. In practice, the attack succeeds when trust is placed in the device instead of the content.
One reason this technique remains durable is that it exploits ordinary operational behavior, not exotic exploitation. A file copied to external media can be carried between business networks, contractor sites, lab systems, kiosks, and offline assets. The same path can also seed secondary propagation if the malware is engineered to copy itself onward after first execution.
Where the attack path breaks down and what defenders should watch
Defensive pressure is strongest at the points where media crosses a trust boundary: insertion, mounting, content inspection, and execution control. If removable media is blocked, tightly allowlisted, or forced through inspection before use, the attacker loses the easiest propagation channel. The risk increases sharply when users can plug in personal devices or move files between zones without device control.
The operational danger is not just infection, but boundary collapse. A single compromised drive can carry malware from a low-trust environment into a high-trust one, or from an isolated system into a managed fleet. That is why removable-media controls belong alongside segmentation and endpoint protections, not as a separate convenience policy.
Effective monitoring looks for unexpected device insertion, unusual file transfer patterns, and execution from removable paths. Security teams should treat repeated use of USB devices, especially in restricted zones, as a potential indicator of propagation or staging rather than a benign productivity event.
For a broader control view, Removable Media and USB Control Guide covers device blocking, allowlisting, encryption, and USB-borne threat management in more operational depth.
Why this technique matters in incident response and containment
Replication through removable media can create a hidden spread pattern that is harder to reconstruct than network-only infection. Hosts may be compromised offline, then reintroduced to a managed environment later, which means the infection timeline can precede any observable network alert. That makes removable media a classic path for silent initial spread and delayed discovery.
The technique also changes the containment problem. If a removable device has already touched multiple systems, it can function as a shared contamination source. Response teams should think in terms of device lineage, host touchpoints, and re-entry paths, not just infected endpoints.
Because removable media can act as both transport and staging space, responders often need to inspect the media itself, not only the computers that used it. That includes looking for copied executables, script launchers, autorun-style artefacts, and evidence that the malware was meant to self-replicate when the device was inserted into another host.
Risk and Threat Considerations
Removable media is a high-value attack path because it bypasses perimeter assumptions and lets malware move through normal human workflows. The practical risk is most serious in environments that depend on isolation, shared kiosks, or cross-zone file movement, because one compromised device can seed multiple hosts before the pattern is visible.
Failure mechanism: The attacker places or lands malware on removable media, then relies on insertion, file opening, or autorun-like behavior to transfer execution onto the next host. Once a new system is reached, the malware can copy itself again, extending propagation beyond the original device.
Impact: Organizations can lose the protection they thought air gaps, segmentation, or offline operation provided. The result can be rapid spread, hidden reintroduction into trusted networks, and longer containment because the media itself must be treated as a suspect artefact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1091 — Replication Through Removable Media | The subject is this ATT&CK technique and its propagation mechanics. |
| Recommendation — Map removable-media transfer paths to T1091 and monitor insertion, execution, and cross-zone spread. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | This technique is a malware propagation path that malware defenses must block and detect. |
| Recommendation — Restrict removable media and scan transferred content before it can execute or spread. | ||
| NIST SP 800-53 Rev 5 | MP-7 — Media Use | Removable media handling and restriction are central to preventing cross-boundary malware spread. |
| SI-3 — Malicious Code Protection | The attack relies on malware execution and propagation through removable media. | |
| AC-19 — Access Control for Mobile Devices | Controlling portable media access is relevant to limiting untrusted device-borne spread. | |
| Recommendation — Enforce media-use restrictions and inspect removable devices before they cross trust boundaries. Scan removable-media content for malicious code before execution or transfer. Limit portable-media use on systems that handle sensitive or isolated workloads. | ||
Practitioner Guidance
What to verify: Confirm whether removable media is actually constrained at the endpoint, not just written into policy. The useful test is whether users can insert unknown devices, access their contents, and move files across trust zones without an enforced scan or control point.
What to prioritise: Focus first on the zones where removable media crosses the highest-trust boundary, such as offline machines, privileged workstations, and systems that bridge secure and less controlled environments. Those are the places where one infected device creates the greatest blast radius.
Decision rule: If a workflow truly requires removable media, treat it as a controlled exception with allowlisting, inspection, and logging. If the media is not operationally necessary, remove the path entirely rather than relying on user judgment at the moment of insertion.
Practitioner takeaway: The main decision is whether removable media is being used as a managed transfer mechanism or as an uncontrolled bridge between trust zones, because attackers only need the latter once.