How do attackers use exfiltration over a physical medium?

How physical-medium exfiltration works

Physical-medium exfiltration is data removal through something local and tangible, most often removable media such as USB storage, external drives, memory cards, or sometimes other nearby devices and peripherals. The key security difference is that the transfer does not need an internet-facing channel, so the act can look like ordinary device use unless endpoint and device controls are in place.

That makes the technique attractive when network egress is watched closely but local device activity is not. An attacker may stage files on the host, copy them in bulk to a portable medium, and leave the environment without triggering the same alerts that a remote upload or cloud transfer would create.

In practice, the method is usually chosen for speed, discretion, or to work around segmented networks. It is also common in environments where staff legitimately use removable storage, because the attacker can blend into normal operational behavior if device policy and logging are weak.

Why defenders miss it

The main blind spot is that many monitoring programs are built around network traffic, proxy logs, and cloud access, while physical transfer happens below those controls. If device insertion is not logged, if removable storage is broadly allowed, or if large file copies are not correlated with endpoint telemetry, the exfiltration path can remain invisible.

This is why the control problem is not only about blocking USB devices. It also includes knowing which endpoints may use them, whether transfers are permitted by role or exception, and whether the environment can distinguish routine business use from suspicious bulk copying. The same gap applies when data is moved to local media and then carried out later, because the exfiltration event and the eventual removal from site may be separated in time.

Physical media also complicates incident scoping. If the organization only watches outbound connections, it may miss the first sign of data loss and only discover the issue after a device inventory check, user report, or downstream leak.

What strong control and response look like

Good practice is to treat removable media as a governed transfer channel, not a convenience feature. Data Exfiltration Guide is useful here because it frames physical-medium exfiltration alongside the broader set of collection and transfer techniques defenders need to detect and contain.

At minimum, defenders should restrict which devices can mount, require approval for exceptions, and log insertions, copy events, and unusual file volume to portable media. Monitoring should focus on size, timing, file type, and destination pattern, not just on whether a removable drive was present. If the environment handles sensitive data, consider blocking write access entirely on high-value systems and using dedicated, managed transfer workstations instead.

When suspicious activity is found, response should include confirming what was copied, whether the medium left the site, and whether the action was legitimate business use or malicious staging. The response playbook should also cover physical evidence preservation, because the device itself may be the best source of forensic detail.

What attackers gain from the approach

Physical-medium exfiltration is especially useful when an attacker wants to avoid network-based detections, operate inside a restricted environment, or move data from a host that has strong perimeter controls but weak endpoint governance. It can also support later stages of an intrusion by enabling quiet collection over time, then one fast removal event.

Because the transfer can be made to look mundane, the attacker may rely on trusted users, shared workstations, or permissive media policies to reduce friction. If the organization allows ad hoc copying to portable storage, the attacker does not need sophisticated tooling to create a serious data-loss path.

That is why exfiltration over physical media should be treated as both a security and an operational-control issue. The technique is simple, but the impact can be severe when sensitive files, credentials, or intellectual property are staged locally and then removed without network telemetry.

Practitioner Guidance

What to verify: Confirm whether removable storage is blocked, approved, or merely discouraged on the systems that matter most. If you cannot answer that quickly from policy and telemetry, you do not have a reliable control story.

Decision rule: If bulk copy to portable media is possible on a sensitive endpoint, prioritize containment of the transfer path before tuning detection rules. If legitimate business use is required, narrow it to approved devices, approved users, and logged exceptions.

What practitioners underestimate: The risk is not only the USB device itself, but the gap between endpoint activity and security visibility. A program that only monitors network egress will often miss the earliest and most actionable evidence of exfiltration.

Practitioner takeaway: The strongest defense is to make physical transfer observable and exceptional, so that any large or unusual copy to local media becomes a deliberate, reviewable event rather than a quiet default.

Related resources from NHI Mgmt Group

• How do attackers use exfiltration over other network medium?
• How do attackers use Exfiltration Over Web Service?
• How do attackers use Exfiltration Over Webhook?
• How do attackers use exfiltration over Bluetooth?