USB worms are old, but they still spread through thousands of networks because a shortcut on a drive looks like a folder and users click it. MITRE ATT&CK tracks this as T1091 Replication Through Removable Media, a Windows technique that sits in two tactics: Initial Access (TA0001), when infected media brings malware into a network, and Lateral Movement (TA0008), when malware copies itself to drives or modifies executables on them so it reaches other hosts, including air-gapped ones. The ATT&CK v20 description also covers mobile devices and charging cables used to infect connected PCs. This guide covers how current worms replicate, the event chain that detects execution from removable media, the Windows settings that break the chain, and how to test and contain an outbreak. It is for detection engineers, endpoint engineers and incident responders. For deliberate drops of infected media, see the USB Drop Attacks Guide.
Key takeaways
- The click replaced AutoRun. Microsoft notes AutoRun is disabled on Windows by default, so modern worms such as Raspberry Robin and the PlugX USB worm rely on a disguised LNK file the user opens.
- Detect the chain, not the file. ATT&CK v20's analytic correlates drive mount, file writes and process execution from the removable path; the parent process of the first execution is usually Explorer launching cmd.exe or a LOLBin.
- One ASR rule does a lot. "Block untrusted and unsigned processes that run from USB" stops unsigned executables, DLLs and screensavers running from removable drives; it does not stop LOLBins launched by a shortcut.
- Air-gapped and OT networks are the high-value target. Stuxnet, Agent.btz, USBferry and PlugX variants were built to cross gaps by riding on drives.
- Worm outbreaks need media hygiene, not just host clean-up. Every drive used on an infected host is a reinfection source until it is scanned or destroyed.
How replication works
ATT&CK describes two modes. In Initial Access, a drive carrying malware is inserted and the malware runs, historically through AutoRun and now mostly through user interaction. In Lateral Movement, malware already on a host watches for removable drives and writes itself to them, or modifies executables stored on them, so the next host that opens the file is infected. Darkhotel's selective infector, which modifies executables on removable media, and Ramsay, which infects portable executable files on removable drives, are the file-infection form; most others copy a loader plus a lure.
The common modern pattern, documented for both Raspberry Robin and the PlugX USB worm, is:
- Hide the real content: the worm moves the user's files into a hidden folder (Sekoia found PlugX used a folder named with a non-breaking space) and hides its own files, for example in a RECYCLER.BIN folder.
- Plant a lure: a Windows shortcut named after the drive or after a USB brand, which looks like a folder.
- User opens it: the shortcut launches cmd.exe or a signed loader that side-loads a malicious DLL; Raspberry Robin's LNK ran cmd.exe, which ran msiexec.exe to fetch a payload from compromised QNAP NAS devices.
- Persist and spread: the malware sets a Run or RunOnce key and starts watching for new drives (every 30 seconds in the PlugX worm Sekoia sinkholed).
T1091 sits next to three other removable media techniques with their own ATT&CK pages: T1052 Exfiltration Over Physical Medium (data out), T1092 Communication Through Removable Media (commands in and out) and T1025 Data from Removable Media (collection). Operational technology has its own version, see MITRE ATT&CK for ICS T0847 Replication Through Removable Media, and mobile has Mobile T1458 Replication Through Removable Media.
Cases
| Actor or software | What is recorded | Source |
|---|---|---|
| Raspberry Robin (S1130) | LNK disguised as a folder; some drives also carried autorun.inf; cmd.exe then msiexec.exe; nearly 3,000 devices in almost 1,000 organisations with a payload alert in 30 days; later part of pre-ransomware activity | Microsoft Threat Intelligence, October 2022 |
| PlugX USB worm, Mustang Panda (G0129) | Shortcut named after the drive, files hidden, DLL side-loading set in RECYCLER.BIN; Sekoia's sinkhole saw about 90,000 to 100,000 unique public IPs a day and over 2.5 million over six months | Sekoia, April 2024; ATT&CK v20 |
| PlugX deletion operation | US Justice Department and FBI, with French law enforcement and Sekoia, deleted PlugX from about 4,258 US computers under court authorisation, announced 14 January 2025 | US Department of Justice |
| Gamaredon Group (G0047) | Replicated to removable media by creating LNKs on all network and removable drives | ATT&CK v20 citing Symantec, April 2025 |
| FIN7 (G0046) | Mailed USB drives to potential victims that installed backdoors, in some cases for ransomware operations | ATT&CK v20 citing an FBI Flash |
| Stuxnet (S0603) | Propagated via removable media using autorun.inf or the CVE-2010-2568 LNK vulnerability | ATT&CK v20 citing Symantec |
| Agent.btz (S0092), APT28 (G0007) | autorun.inf on removable media (Agent.btz); a tool that infects USB devices to reach air-gapped computers (APT28) | ATT&CK v20 |
| Tropic Trooper (G0081) | USBferry copied its installer to USB storage to reach air-gapped military networks | ATT&CK v20; Trend Micro, May 2020 |
The Mustang Panda profile covers PlugX in its wider campaign context: see the Mustang Panda Threat Actor Profile Guide.
What to detect and where
ATT&CK v20 has one detection strategy for T1091, DET0301 Removable Media Execution Chain Detection via File and Process Activity, with a single Windows analytic (AN0841). It correlates a drive mount with file writes, autorun use and process execution from the removable path, and exposes drive letter match, file execution window, parent process and file entropy as tuning elements.
| Stage | Telemetry | What to look for |
|---|---|---|
| Device arrives | Security 6416 (Audit PNP Activity); System log drive events listed in DET0301; EDR device events | New removable disk; record the device ID for later scoping |
| Worm writes to drive | Sysmon 11 file create; Audit Removable Storage 4663 | .lnk, .dll or .exe files and hidden folders written to a removable root by a non-Explorer process; autorun.inf creation |
| User opens lure | Sysmon 1 or Security 4688 process creation; UserAssist registry updates | explorer.exe spawning cmd.exe, msiexec.exe, rundll32.exe or a signed binary from a removable drive letter |
| Payload runs | Sysmon 1, 7 (image load), 3 and 22; Defender ASR events | DLL side-loading from removable media; msiexec fetching a remote package; AsrUntrustedUsbProcessAudited or AsrUntrustedUsbProcessBlocked |
| Persistence and spread | Sysmon 13 registry value set | New Run or RunOnce values pointing at AppData or ProgramData; repeated writes to every newly mounted drive |
High-signal analytics
- Shell from shortcut on removable media: explorer.exe launching cmd.exe or msiexec.exe whose command line references a removable drive letter or a .lnk on it.
- Network install by msiexec: msiexec.exe with a remote URL as the package source shortly after a drive mount, the Raspberry Robin pattern.
- Same files on many drives: identical hashes written to the root of several different removable devices from one host, a sign of an active worm.
- Executable modification on media: writes to existing .exe files on a removable volume, the Darkhotel and Ramsay infection pattern.
Microsoft also recommends making sure full scans include removable drives, using the Set-MpPreference removable drive scanning setting in Defender Antivirus.
Mitigations
| Control | Source | Detail | Limits |
|---|---|---|---|
| M1042 Disable or Remove Feature or Program | ATT&CK v20 | Disable AutoRun where not needed; disallow removable media at policy level where not required. The NoDriveTypeAutoRun value under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer disables AutoRun by drive type (0x04 removable, 0x08 fixed, 0x10 network, 0x20 CD-ROM) | Does not stop a user opening a shortcut |
| M1040 Behavior Prevention on Endpoint | ATT&CK v20; Microsoft ASR reference | ASR rule "Block untrusted and unsigned processes that run from USB", GUID b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4, blocks unsigned or untrusted .exe, .dll and .scr from USB and SD cards; audit and block action types available | Files can still be copied to disk; signed LOLBins are not blocked |
| M1034 Limit Hardware Installation | ATT&CK v20 | Device installation restrictions and device control (read-only or blocked execute on removable storage) | Needs exceptions for approved media |
| Block execute from removable storage | NHI Mgmt Group recommendation | Device control execute-deny on removable storage, plus application control rules that deny execution from removable paths | Breaks portable tools; publish an approved alternative |
| Show hidden files and extensions on managed devices | NHI Mgmt Group recommendation | Makes a .lnk lure and hidden folders visible to the user | User awareness, not a technical barrier |
| Transfer stations for air-gapped zones | NHI Mgmt Group recommendation | A single scanning station; removable storage disabled on every other host | Process discipline required |
Microsoft's Raspberry Robin report observed that many organisations had re-enabled AutoRun through legacy Group Policy, so check your effective policy rather than assuming the default. For broader removable media policy, see the Removable Media and USB Control Guide; for LNK and other risky file types, see Risky File Types.
Where identity fits
Worms run as the user who opened the shortcut, so the blast radius is set by that user's rights. A worm opened in an administrator session can install services and spread through admin shares as well as drives. Keep daily-use accounts unprivileged, and never use privileged or shared operator accounts on engineering and air-gapped hosts to open media. Microsoft's Raspberry Robin analysis describes a UAC bypass through fodhelper.exe, which shows why local admin membership for standard users matters even when UAC is on.
Responding to an outbreak
- Scope by device: use 6416 and EDR device events to list every removable device ID that touched an infected host, and every other host those devices touched.
- Contain: switch removable storage to block or read-only for the affected scope, isolate hosts with active persistence, and enable the ASR USB rule in block mode.
- Clean hosts: remove Run and RunOnce persistence and dropped files; check for follow-on payloads such as ransomware precursors in the Raspberry Robin case.
- Clean media: recall and scan or destroy every drive in scope; restore hidden user files on legitimate drives.
- Roll back controls deliberately: return the scope to the normal policy only after two clean weeks of device and process telemetry.
How to roll out and test
- Audit first: enable the ASR USB rule in audit mode and device control execute auditing for four weeks; review which legitimate tools run from removable media.
- Fix the AutoRun baseline: confirm through Resultant Set of Policy that AutoRun is disabled for all drive types.
- Enforce in rings: move the ASR rule and execute-deny to block for IT, then business units, keeping the audit policy ready to reapply if a ring breaks.
- Test: with approval, place a harmless unsigned test executable and a test shortcut that launches cmd.exe on a lab drive; confirm the ASR block, the DET0301-style alert and the 6416 record.
Measuring whether it works
- ASR coverage: share of Windows endpoints with the USB rule in block mode.
- Execution from removable media: monthly count of processes launched from removable paths, trending down.
- AutoRun drift: number of devices where effective policy re-enables AutoRun.
- Outbreak scoping time: time to list every device and host in scope after a worm detection.
Common failure patterns
- Relying on AutoRun being off: LNK-based worms never needed it, and legacy GPOs sometimes turn it back on.
- ASR rule left in audit: deployed years ago for testing and never enforced.
- Cleaning hosts but not drives: the infection returns from the same USB sticks within days.
- Exempting engineering and OT laptops: the machines that most often bridge air gaps are excluded from controls.
- No device telemetry: without 6416 or EDR device events, responders cannot scope which drives spread the worm.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | TA0001, TA0008; T1091; DET0301; M1034, M1040, M1042 | Technique, detection strategy and mitigations |
| MITRE D3FEND | D3-EAL Executable Allowlisting; D3-IOPR IO Port Restriction | Defensive techniques NHI Mgmt Group considers relevant |
| NIST SP 800-53 Rev. 5 | MP-7 Media Use; CM-7 Least Functionality; SI-3 Malicious Code Protection | Media restriction, disabling AutoRun, scanning |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Preventing unauthorised software; monitoring computing hardware and software |
Practitioner checklist
- Confirm AutoRun is disabled for all drive types in effective policy on every Windows host.
- Enforce the ASR rule "Block untrusted and unsigned processes that run from USB" after an audit period.
- Deny execute on removable storage through device control where business allows.
- Alert on explorer.exe launching cmd.exe, msiexec.exe or rundll32.exe from a removable path.
- Alert on .lnk, .dll and hidden folders written to removable roots by non-Explorer processes.
- Collect 6416 and device IDs so outbreaks can be scoped by drive.
- Include removable drives in antivirus full scans.
- Keep a media recall and scanning procedure in the incident playbook.
Standards and references
- MITRE ATT&CK: Replication Through Removable Media (T1091)
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Using the registry to disable AutoRun
- Microsoft Learn: 6416(S) A new external device was recognized by the system
- Microsoft Threat Intelligence: Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
- Sekoia: Unplugging PlugX, sinkholing the PlugX USB worm botnet
- US Department of Justice: Operation to delete PlugX malware
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Mustang Panda Threat Actor Profile Guide · USB Drop Attacks Guide · Removable Media and USB Control Guide · MITRE ATT&CK for ICS T0847 Replication Through Removable Media