Replication Through Removable Media T1091
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of…
- Tactics
- Lateral Movement, Initial Access
- Actors using it
- 8
- Sub-techniques
- 0
Ransomware groups reported using it
Threat actors
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Tropic TrooperPirate Panda, KeyBoy · 35 techniques
- LuminousMothChina · 24 techniques
- DarkhotelSouth Korea · DUBNIUM, Zigzag Hail · 22 techniques
- Aoqin DragonChina · 9 techniques