Procedure examples

Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Ursnif has copied itself to and infected removable drives for propagation.

Crimson can spread across systems by infecting removable media.

Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.

Raspberry Robin has historically used infected USB media to spread to new victims.

Conficker variants used the Windows AUTORUN feature to spread through USB propagation.

PlugX has copied itself to infected removable drives for propagation to other victim devices.

DustySky searches for removable media and duplicates itself onto it.

USBferry can copy its installer to attached USB storage devices.

Unknown Logger is capable of spreading to USB devices.

USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.

Ramsay can spread itself by infecting other portable executable files on removable drives.

Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.

njRAT can be configured to spread via removable drives.

HIUPAN has periodically checked for removable and hot-plugged drives connected to the infected machine, should one be found HIUPAN will propagate to the removeable drives by copying itself and accompanying malware components to a directory to the new drive in a hidden subdirectory `<Drive_Letter>:\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\` and hides any other existing files to ensure UsbConfig.exe is the only visible file on the device.

ANDROMEDA has been spread via infected USB keys.

QakBot has the ability to use removable drives to spread through compromised networks.

H1N1 has functionality to copy itself to removable media.

Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.