MITRE ATT&CK T1092 Communication Through Removable Media: Detecting C2 Across the Air Gap

An air gap stops network C2, but not a USB stick that is carried between a connected machine and an isolated one every day. MITRE ATT&CK T1092 Communication Through Removable Media, a Command and Control (TA0011) technique for Windows, Linux and macOS, describes adversaries relaying commands and files between compromised hosts on disconnected networks by writing them to removable media. Both ends must be compromised, usually an internet-connected host first and the isolated host later. This guide covers the recorded procedures, the v20 detection strategy, mitigations and testing. It is for teams defending classified, industrial, laboratory and other isolated networks, and the SOC teams that monitor the connected side. For USB controls in general, see the Removable Media and USB Control Guide.

Key takeaways

• The drive is the C2 channel. Commands go in on the connected side, run on the isolated side, and results come back on the next trip, so latency is days, not seconds.
• Two compromised hosts are needed. Detection on the connected host, which has telemetry, is often the only chance to see the relay.
• It is an old, proven technique. ESET traced APT28's USBStealer back to at least 2005, and counted 17 air-gap frameworks in 2021, all using USB drives.
• ATT&CK's mitigations are blunt and effective. M1042 disables Autorun and M1028 restricts removable media by policy; device control and a transfer station add the rest.
• Isolated networks are blind spots. They send no telemetry out, so logging must be collected locally and reviewed.

What T1092 covers

ATT&CK v20 describes C2 between compromised hosts on potentially disconnected networks, using removable media to transfer commands from system to system. It expects the isolated host to be reached through T1091 Replication Through Removable Media, with commands and files then relayed between the disconnected system and the internet-connected one the adversary controls directly. Related techniques sit either side of it:

Map each detection to the step it actually sees, so coverage gaps are visible. The ICS view of replication is in MITRE ATT&CK for ICS T0847 Replication Through Removable Media.

How adversaries have used it

• USBStealer (APT28): ESET's November 2014 analysis describes a courier protocol. On the connected machine, a dropper writes a payload and an AUTORUN.INF file, with hidden and system attributes, to each inserted drive, plus a marker file showing the drive has touched an internet-connected host. On the isolated machine the payload creates a folder named after that computer, so operators can see which machines are reachable, collects files of interest and writes them to the drive on its next visit. Operators return commands as an encrypted file named for the target computer, which the isolated host decrypts and runs. Files that cannot be copied wait for the next drive. ESET believed the tool had been used since at least 2005.
• CHOPSTICK (APT28): ATT&CK records CHOPSTICK modules copying themselves to air-gapped machines and using files written to USB sticks to carry data and command traffic. See the APT28 (Fancy Bear) Threat Actor Profile.
• The wider pattern: ESET's December 2021 study of 17 frameworks built to breach air-gapped networks found that all used USB drives as the medium, with no real or suspected covert physical channel. About half were one-way, exfiltration only; the bidirectional ones supported a small command set such as stealing files that match patterns or running a file on the drive. Over 75% used malicious LNK or autorun files for initial compromise or lateral movement. Some needed a connected host preparing the drives; others relied on an operator on the ground carrying them.

What to detect and where

ATT&CK v20 assigns detection strategy DET0090 Cross-host C2 via Removable Media Relay. Its analytics look for the full sequence: media mounted, files written or updated, then the same files read or executed on a different host.

Making it work in practice

• Track the device, not just the event: record vendor ID, product ID and serial number on every insert, so the same drive can be followed between connected and isolated hosts. Microsoft Defender for Endpoint device control, for example, logs RemovableStoragePolicyTriggered events with serial number and VID_PID for Advanced Hunting.
• Audit file access on removable storage: the Windows Audit Removable Storage subcategory logs Event IDs 4656, 4658 and 4663 for reads and writes to removable drives; Microsoft recommends Success and Failure auditing.
• Hash files across hosts: a file written to a drive on host A and opened or executed on host B is the core T1092 signal. File creation events with hashes from both sides make the join possible.
• Look for hidden and system attributes on drive files, autorun files, LNK files at the drive root and unexpected folders named after computers.
• Collect logs from the isolated side: forward to a local collector inside the enclave and review on a schedule, or export logs through the controlled transfer process. Without this, half of every analytic is missing.
• Watch the connected side for drive watchers: processes that run continuously and react to every new drive letter, then write to it, are the connected half of the courier.

Mitigations

See the M1042 Disable or Remove Feature or Program and M1028 Operating System Configuration pages.

Where identity fits

Isolated networks often run on shared local accounts, long-lived service accounts and passwords that never rotate, because the usual identity tooling cannot reach them. A courier implant inherits whatever the logged-on account or the service it hijacks can do. Use named accounts for operators, give transfer kiosks their own scoped service accounts, register each issued drive to a named custodian, and include enclave service accounts and their credentials in your inventory and rotation schedule even when rotation is manual.

Rolling it out

1. Map the crossings: list every isolated network and every way data crosses into or out of it, with owners and frequency. Many enclaves have more crossings than their documentation shows.
2. Disable Autorun and Autoplay everywhere: low risk and immediate; check on both connected and isolated hosts.
3. Deploy device control in audit mode: log every removable storage use with serial number for four weeks to learn which devices and users really need access.
4. Introduce issued media and a transfer station: register approved drives, then move device control to block everything else on isolated hosts. Keep the audit policy as the rollback option for a defined period.
5. Turn on removable storage auditing and local log collection in the enclave, and agree how often logs are reviewed or exported.
6. Build the cross-host analytic: join file hashes and drive serials from both sides of each crossing.

How to test

• Policy test: insert an unregistered drive into an isolated host and confirm it is blocked and logged with serial number.
• Relay simulation: in an authorised exercise, write a benign marker file with hidden attributes on a connected test host, carry the drive to an isolated test host, and open it there. Confirm the drive serial and file hash are visible on both sides and the cross-host analytic fires.
• Autorun test: place a benign autorun.inf on a test drive and confirm nothing runs on insertion.
• Transfer station test: send a test file with appended data or an unexpected file type through the kiosk and confirm it is flagged.

Decision guidance

• Block or control: where an isolated system has no business need for removable media, block it outright. Where it does, allow only registered, encrypted drives through a transfer station.
• Removable media or data diode: if the flow is one-way and regular, such as logs out of an OT network or updates in, a diode removes the courier risk. Removable media remains for irregular, two-way needs.
• Small organisations: disable Autorun, restrict drives with built-in OS policy, use one dedicated scanning machine for anything going into isolated systems.
• Large or regulated organisations: endpoint device control with serial allowlists, staffed transfer stations, separate inbound and outbound media, and local SIEM collection inside the enclave.

Measurement

• Autorun disabled: share of hosts, connected and isolated, with Autorun and Autoplay off.
• Media control enforcement: share of isolated hosts where only registered devices can mount.
• Transfer compliance: share of media entering isolated networks that passed through the transfer station.
• Log coverage: share of isolated hosts whose removable storage and process logs are collected and reviewed on schedule.
• Exercise result: whether the relay simulation was detected, and how long after the drive reached the isolated host.

Common failure patterns

• Treating the air gap as the control: assuming no network means no C2, while drives cross daily, the premise of every framework ESET studied.
• Autorun left on in the enclave: old or unmanaged isolated systems keep defaults that the connected estate dropped long ago.
• Same drive both ways: one stick carries updates in and reports out, giving the courier its loop.
• No logs from the isolated side: the half of the relay that runs the commands is never seen.
• Unregistered drives: device control that blocks by device class only, so any USB storage from the right class is allowed.

Framework mapping

The tactic view is in the ATT&CK Command and Control Tactic guide.

Practitioner checklist

• Document every isolated network and every route by which data crosses its boundary.
• Disable Autorun and Autoplay on connected and isolated hosts.
• Restrict removable media on isolated hosts to registered, encrypted drives, by serial number.
• Route all inbound media through a hardened transfer station that copies to fresh media.
• Use separate media for inbound and outbound transfers.
• Enable removable storage auditing and collect isolated-side logs locally.
• Correlate drive serial numbers and file hashes across both sides of each crossing.
• Run a relay simulation at least yearly and fix what it misses.

Standards and references

• MITRE ATT&CK: T1092 Communication Through Removable Media
• MITRE ATT&CK: M1042 Disable or Remove Feature or Program
• ESET Research: Sednit espionage group attacking air-gapped networks
• ESET Research: Jumping the air gap, 15 years of nation-state effort
• Microsoft Learn: Autoplay Policy CSP
• Microsoft Learn: Manage device installation with Group Policy
• Microsoft Learn: Audit Removable Storage
• Microsoft Learn: Device control in Microsoft Defender for Endpoint

Related NHI Mgmt Group resources: Removable Media and USB Control Guide, USB Drop Attacks Guide, Command and Control (C2) Guide, APT28 (Fancy Bear) Threat Actor Profile, MITRE ATT&, MITRE ATT&, MITRE ATT&.