How do attackers use USBferry?

How USBferry Works as a Removable-Media Worm

USBferry is attractive to attackers because it turns a portable drive into a delivery and transfer mechanism rather than relying on network reach. Once a USB device touches a new system, the malware can copy itself, stage files for execution, and look for the next removable-media hop. That makes it useful for crossing boundaries that are intentionally disconnected.

In practice, the technique depends on ordinary user behaviour and weak endpoint discipline. A drive moved between laptops, jump hosts, lab systems, or contractor environments can become the bridge that carries the payload onward. The attack does not need a direct internet path if the removable medium is permitted to enter each environment.

For background on how worm-like malware families spread and evade basic inspection, see Malware Guide.

Why Air-Gapped Environments Are Still Exposed

Air-gapped and tightly controlled systems reduce network attack paths, but they do not remove the human and media paths that attackers can abuse. USBferry works precisely because the trusted boundary is often weaker at the point where removable media is introduced, mounted, browsed, or shared. If policy allows even limited USB use, the environment has an import channel that must be treated as a security boundary.

The practical weakness is usually not the air gap itself, but the workflow around it. File transfers, maintenance tasks, and offline updates often rely on removable media, and those routines can create predictable opportunities for malware propagation. An attacker only needs one successful transfer into one managed system to start the chain.

Worm-like propagation and cross-environment movement are also a recurring pattern in real intrusions, as shown in The State of NHI & AI Agent Breach Report 2026, which highlights how attackers exploit trusted paths and reused access mechanisms.

What Defenders Should Watch and Control

Defence is mostly about reducing the number of ways a USB device can execute or introduce content. Restrict autorun and autoplay behaviour, limit removable-media permissions, and prefer allowlisted transfer workflows for approved operations. A secure program also treats USB use as observable, not merely permitted, because the risk is in the movement path as much as in the payload.

Detection should focus on indicators that match the propagation method: unexpected shortcuts, duplicate filenames, hidden executables, or newly created files that appear after a drive has crossed from one zone to another. Endpoint telemetry that records device insertion and file creation events is especially useful when the same media may touch multiple security zones.

For control planning, CISA cyber threat advisories are useful for tracking attacker tradecraft, while MITRE ATT&CK Enterprise Matrix helps map removable-media propagation, execution, and follow-on movement into a huntable framework.

Risk and Threat Considerations

The main risk is that a trusted physical transfer path can bypass network isolation and let malware persist where internet-based controls are absent. Once a removable drive is accepted into a protected zone, the attacker can use it as a low-friction carrier for payload staging, re-entry, and secondary spread.

Failure mechanism: The environment trusts removable media too broadly, so a contaminated drive can introduce code, shortcuts, or staged files that survive basic perimeter controls and reach isolated hosts.

Impact: Malware can move from one disconnected environment to another, compromise maintenance or operator workstations, and create an infection path that is harder to detect than ordinary network delivery.

Practitioner Guidance

What to prioritise: Treat USB use as a controlled exception process, not a convenience feature. If removable media is needed, define which systems may read it, which media are approved, and which file types are acceptable.

What to verify: Confirm that autorun is disabled, that removable-media policies are actually enforced on endpoints, and that scanning occurs before files are opened or copied into sensitive zones. If portable drives routinely cross security boundaries, verify that event logging captures both device insertion and file creation.

Practitioner takeaway: USBferry succeeds when organisations assume the air gap ends at the network port; in reality, the removable-media workflow is the attack surface and must be governed like one.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?