An isolated control network still has a door, and it is the USB drive, laptop or DVD that someone carries through the site gate. MITRE ATT&CK for ICS tracks this as T0847 Replication Through Removable Media, an Initial Access technique for Windows, Linux, embedded and network device assets. ATT&CK describes adversaries copying malware to removable media that is then inserted into the control systems environment, often by a supplier or contractor who does not know it is infected. This guide is for OT security leads, control engineers and site managers. It goes past the general removable media controls covered elsewhere and focuses on what is different in plant environments: the transfer workflow, third-party media, the assets you cannot run agents on, OT-specific detection, and safety-aware response. Defensive framing only.
Key takeaways
- Air gaps move the attack to people and media. ATT&CK notes this technique reaches devices that never connect to untrusted networks but are physically accessible, so isolation without media control is incomplete.
- Accidental infection is the common case. The public OT cases are mostly commodity malware carried in by staff or contractors, and they still caused weeks of downtime.
- Build one approved path for files. A scanning station, an allowlist of approved devices and a logged hand-off beat a blanket ban that engineers work around.
- Detect insertion followed by execution. MITRE's OT analytics look for an unapproved USB device on an engineering workstation or HMI followed by a process running from the removable drive.
- Respond as an engineering event. Infected engineering workstations may have no clean backup; cleaning them can affect operations, so recovery is planned with operations and the vendor.
What T0847 covers, and what the general guidance misses
The enterprise version of this behaviour is T1091 Replication Through Removable Media, covered in the Removable Media and USB Control Guide guide, and the general controls (device installation restrictions, encrypted drives, USB DLP) are in the Removable Media and USB Control Guide. Deliberately dropped devices are covered in the USB Drop Attacks Guide. Three things change in OT:
- Media is part of operations: project files, firmware, historian exports, vendor patches and configuration backups often travel by USB because the network was designed to keep them out.
- Third parties carry it: ATT&CK highlights suppliers and contractors with access privileges as the unknowing carriers.
- Endpoint controls are uneven: HMIs and engineering workstations may run older Windows builds with vendor-certified configurations, and embedded devices run no agent at all.
For the ICS matrix as a whole, see the MITRE ATT&CK for ICS Guide.
What the public cases teach
| Case | What happened (per the cited source) | Control lesson |
|---|---|---|
| Stuxnet (S0603), first reported 2010 | ICS-CERT advisory ICSA-10-201-01C reported that the malware ran when a USB drive was opened in a file manager, using a Windows shortcut (LNK) flaw, so it did not need AutoRun. ATT&CK records self-replication through removable drives and notes an insider or third party such as a contractor may have carried the media in. | Disabling AutoRun is necessary but not sufficient; block execution from removable media and patch the host. |
| US power generation facilities, late 2012 | The ICS-CERT Monitor for October to December 2012 reported that malware carried on a USB drive was found on two engineering workstations critical to the control environment, which had no backups; at a second plant a third-party technician's USB drive used for software updates during an outage infected about 10 turbine control computers and delayed restart by about three weeks. | Scan every drive before use, keep tested backups of engineering workstations, and control contractor media. |
| Gundremmingen nuclear plant, Germany, 2016 | ATT&CK for ICS records that the operator found Conficker (S0608) and W32.Ramnit on a computer not connected to the internet and on eighteen removable drives, and later checked and cleaned more than 1,000 computers. | Internet disconnection does not stop infection; inventory and scan media as well as hosts. |
For the wider malware history, see the ICS Malware History Guide.
Mitigations MITRE maps to T0847
| Mitigation | MITRE's guidance | OT implementation |
|---|---|---|
| M0934 Limit Hardware Installation | Enforce system policies or physical restrictions to limit hardware such as USB devices on critical assets | Device installation restrictions allowing only approved device instance IDs on HMIs and engineering workstations; port blockers or locked enclosures on assets that cannot take policy; disabled ports in BIOS or UEFI where the vendor supports it |
| M0942 Disable or Remove Feature or Program | Consider disabling features such as AutoRun | Group Policy "Turn off Autoplay" (all drives), "Set the default behavior for AutoRun" to disable autorun commands, and "Disallow Autoplay for non-volume devices", under Administrative Templates, Windows Components, AutoPlay Policies |
| M0928 Operating System Configuration | Harden the system through operating system controls to prevent the use of malicious removable media | Deny execute and write on removable storage for all but named transfer accounts; application allowlisting so nothing launches from a removable drive letter (see the Application Allowlisting Guide) |
Test every host policy change on a representative asset first and confirm with the control system vendor that it does not affect certified software, as ICS-CERT advised when it published the Stuxnet mitigations.
Designing the approved transfer path
NIST SP 800-82 Rev. 3 (section 6.2.7, Media Protection) says unauthorised removable media or devices should not be used on any OT node or anything connected to OT, and that procedural or technical controls should prevent malware introduction. Section 6.2.5 adds that maintenance devices should stay within the OT environment and be disconnected after maintenance. The practical answer is a single, logged path that is easier to use than a workaround.
- Dedicated media: issue OT-only drives, labelled and inventoried, that never leave the site and are never used in corporate machines. Encrypt them where the OT host can read encrypted media.
- Scanning station: a hardened station outside the control zone with more than one anti-malware engine and signatures updated daily, which scans the incoming file and writes it to a fresh OT-only drive. ICS-CERT recommended cleaning USB devices before each use or using write-once media such as CDs or DVDs.
- File allowlist: accept only the file types the task needs (project archives, firmware images, documents) and verify vendor hashes or signatures on firmware and patches before transfer.
- Logged hand-off: record who brought the file, the work order, the hash and the destination asset. The record becomes your investigation trail.
- Network alternative: where volumes justify it, replace sneakernet with a controlled file transfer service in the DMZ or a one-way path outward. See the Data Diodes and Unidirectional Gateways Guide and the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Decision guidance
| Situation | Recommended approach (NHI Mgmt Group) |
|---|---|
| Small site, few transfers a month | Scanning station plus OT-only drives and a paper or ticket log; port blockers on HMIs |
| Large site or fleet | Central managed scanning stations, device control policy from OT management servers, logs into the OT SOC |
| Legacy hosts that cannot take policy | Physical port control, locked cabinets and two-person rule for any media use |
| Contractor laptops connecting to OT | Prefer site-owned transient laptops kept in OT; if the contractor's own laptop is unavoidable, scan and check its patch and anti-malware state before connection |
Where identity fits
Every media transfer should be tied to a named person and a work order, not a shared "engineering" login. Restrict removable storage write and execute rights to specific transfer accounts on engineering workstations, and make contractors sign media in and out against their own identity. When an infection is found, this is what lets you answer "which drive, which person, which other assets". See the OT Third-Party and Integrator Access Guide and the Engineering Workstation Security Guide.
Detection and measurement
ATT&CK for ICS v20 sets out analytics for this technique per platform, each gated so that alerts fire only outside approved activity such as scheduled maintenance, commissioning and documented vendor support.
| Asset | Signal (from MITRE's analytics) | Log source |
|---|---|---|
| Windows HMI or engineering workstation | USB storage inserted whose hardware ID is not on the allowlist, followed by a process running from the removable drive or files written into engineering project folders | Windows System log device installation events (MITRE cites event 20001); Sysmon event 1 (process create) and event 11 (file create) |
| Linux OT asset | Removable block device mounted outside the approved workflow, then a binary executed from /media or /mnt | auditd execve and mount records |
| Network device | New MAC address on a previously unused switch port after physical access, followed by ICS protocol traffic to field devices | Switch syslog |
| Embedded field device | File transfer to a field device (for example DNP3 file transfer or IEC 61850 file services) from a source not on the engineering workstation list, outside a change window | OT network monitoring protocol decoder |
Feed these into the plant's monitoring; see the OT Network Security Monitoring Guide.
Metrics:
- Percentage of HMIs and engineering workstations with removable storage restricted by policy or physical port control.
- Percentage of media transfers into OT that passed through the scanning station, from the transfer log.
- Unapproved USB insertions detected per month on OT assets, and time to triage each.
- Malware detections at the scanning station per quarter, split by staff and contractor media.
- Percentage of engineering workstations with a backup restored successfully in the last 12 months.
Rolling out the controls
- Discover: list every OT asset with usable USB ports and every routine reason media enters the plant (backups, patches, historian exports, vendor visits).
- Stand up the path: deploy the scanning station and OT-only drives before restricting anything, so people have an approved route on day one.
- Audit mode: enable device installation auditing and USB logging on a pilot HMI and engineering workstation for a few weeks; build the allowlist from what you see, including keyboards, licence dongles and vendor tools.
- Enforce in rings: engineering workstations first, then HMIs, then servers, each during a planned outage window with the vendor's agreement.
- Rollback: keep a documented, tested procedure to lift the device restriction on one host (local policy override held by the site lead) in case a vendor tool or licence dongle is blocked during an emergency.
- Sustain: review allowlists quarterly, retest backups, and brief contractors at site induction.
Responding to an infected drive or host
Follow the OT Incident Response Guide, with these technique-specific steps:
- Quarantine the media, do not wipe it: the drive is evidence and tells you the malware family and likely spread.
- Trace the drive: use the transfer log to find every asset it touched and every other drive filled from the same source.
- Assess with operations: the 2012 case showed infected engineering workstations without backups, where a failed clean-up could have impaired operations. Decide clean-up timing with the plant manager and vendor.
- Check for spread: commodity worms such as Conficker also spread over network shares; scan the whole zone, not just the host.
- Rebuild from known good: restore from validated images and project file backups, then re-verify control logic against the approved version.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0847; M0934, M0942, M0928 | Technique and mapped mitigations |
| MITRE ATT&CK for ICS v20 | T0862 Supply Chain Compromise; T0863 User Execution; T0895 Autorun Image | Related techniques in the same chains |
| NIST SP 800-82 Rev. 3 | Section 6.2.7 Media Protection; section 6.2.5 Maintenance | OT media and maintenance device guidance |
| NIST SP 800-53 Rev. 5 | MP-7 Media Use; SC-41 Port and I/O Device Access; CM-7 Least Functionality; SI-3 Malicious Code Protection | Media restriction, port control and scanning |
| NIST CSF 2.0 | PR.PS-01; DE.CM-09 | Configuration management and monitoring of computing hardware |
For zone and conduit requirements see the IEC 62443 Guide.
Common failure patterns
- Relying on the air gap. The Gundremmingen case shows malware on an unconnected computer and eighteen drives.
- AutoRun off, execution still allowed. Stuxnet did not need AutoRun; only blocking execution from removable media and patching close that route.
- Contractor media outside the process. The 2012 turbine control infection came from a technician's update drive during an outage, the busiest and least supervised time on site.
- Backup drives that travel. A drive used to back up configurations is also a carrier if it is ever used elsewhere.
- No tested backup of engineering workstations. Clean-up becomes a production risk instead of a routine rebuild.
- A ban with no approved path. Engineers still need files; without a scanning station they find another way in.
Practitioner checklist
- Inventory every OT asset with active USB or media ports.
- Deploy a hardened scanning station and OT-only labelled drives.
- Turn off AutoPlay and AutoRun on all OT Windows hosts by policy.
- Block execution from removable drives with allowlisting or OS policy.
- Restrict USB storage to approved device IDs, or physically block ports where policy is not possible.
- Log every transfer with person, work order, file hash and destination.
- Verify vendor firmware and patch hashes or signatures before transfer.
- Alert on unapproved USB insertion followed by execution on HMIs and engineering workstations.
- Test restore of every engineering workstation at least yearly.
- Brief contractors on the media process at site induction.
Standards and references
- MITRE ATT&CK: Replication Through Removable Media (ICS)
- MITRE ATT&CK: Stuxnet
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: ICSA-10-201-01C USB Malware Targeting Siemens Control Software
- NIST: SP 800-53 Rev. 5
- Microsoft Learn: AutoPlay Policy CSP
- POWER (secondary press summary of the ICS-CERT Monitor, October to December 2012): DHS, USB drives spread malware in control system environment at two power plants
Related NHI Mgmt Group resources: Nuclear Facility Cybersecurity Guide · MITRE ATT&CK for ICS T0862 Supply Chain Compromise · Removable Media and USB Control Guide · NIST SP 800-82 OT Security Guide