How do attackers use communication through removable media?

How attackers turn removable media into a communication path

Removable media gives attackers a way to move information without using the normal network path. That matters because it can cross air gaps, bypass egress controls, or let an operator stage data on one system and collect it later from another. In practice, the media is not just a file carrier, it becomes a low-visibility transfer channel.

Attackers also use the device itself as a bridge between trust zones. A USB stick introduced into a restricted workstation can deliver tools, updates, payloads, or collected data, and the same medium may later be used to move those artifacts out again. The communication is often asynchronous, which makes it harder to observe than live network traffic.

In Command and Control (C2) Guide, removable media appears alongside other covert channels because adversaries use it to pass instructions or exchange staged content when ordinary beaconing would be noisy or blocked. The same idea shows up in Removable Media and USB Control Guide, which focuses on device control, allowlisting, and scanning as the practical countermeasures for this channel.

Why removable media is attractive to attackers

Removable media is useful because it is common, portable, and often trusted by users and endpoints. That makes it a flexible way to move malware, staging archives, scripts, logs, screenshots, or other collected material between systems that should not normally exchange data.

It is also attractive when defenders rely heavily on network monitoring. A transfer over USB, external storage, or another physical medium may never touch a proxy, firewall, or DNS sensor, so the attacker gets a path that is outside the usual detection stack. In mixed environments, the same property can be used for initial intrusion, follow-on access, or quiet data removal.

Data Exfiltration Guide is relevant here because exfiltration over USB is part of the broader pattern of moving data through alternate channels rather than across normal network routes. The most important operational point is that removable media often serves two roles at once, collection on one side and delivery on the other.

What defenders need to control on endpoints and media

The main defensive issue is not the presence of removable media alone, but whether the environment allows untrusted devices to become an accepted communication channel. That requires policy, technical enforcement, and logging to line up, because any gap can let an attacker use the device as a covert bridge.

Controls should focus on limiting which devices can mount, what can execute from them, and whether content is scanned before it is opened. On sensitive endpoints, teams should also watch for unusual insertion events, unexpected file transfers, and repeat access to removable storage around restricted workstations.

For the media itself, sanitization and reuse matter when devices move between zones or owners. NIST SP 800-88 Media Sanitization is useful when removable media is retired, repurposed, or handled after a sensitive transfer, because residual data can otherwise become part of the attacker’s communication path.

Risk and Threat Considerations

Removable media creates a control bypass risk because it can move data and code across boundaries that were meant to restrict normal network communication. The same device can also carry malware into a protected environment and carry collected data back out, so the exposure is both inbound and outbound.

Failure mechanism: The attacker exploits trust in portable storage, weak device control, or incomplete endpoint inspection to move files between isolated systems without using approved network paths.

Impact: This can enable malware introduction, data staging, covert exfiltration, and cross-zone contamination, especially where sensitive systems are assumed to be unreachable from ordinary channels.

Practitioner Guidance

What to verify: Confirm that removable-media policy is enforced technically, not just documented. If a system can mount unauthorized devices, execute from external storage, or transfer data without logging, the channel is still available to an attacker.

Decision rule: If a sensitive endpoint must accept removable media, treat every insertion as a security event, require scanning before trust, and restrict the device class or user role that can perform the transfer. If the system does not need the capability, block it outright.

What practitioners underestimate: The risk is often not a single USB event, but the combination of persistence, portability, and weak observability. Once an attacker learns that a site tolerates offline transfer, removable media can become the easiest route for repeat access and data movement.

Practitioner takeaway: Treat removable media as a communications channel with security implications, not just a storage accessory, and validate that your controls block both malicious inbound content and unauthorized outbound transfer.

Related resources from NHI Mgmt Group

• How do attackers use Replication Through Removable Media?
• How do attackers use data from removable media?
• Communication Through Removable Media
• How do attackers turn a supply-chain incident into wider NHI compromise?