Skip to content

Replication Through Removable Media

Technique · ATTACK:enterprise:T1091

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1091",
  "title": "Replication Through Removable Media",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1091",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3b744087-9945-4a6f-91e8-9dbceda417a4",
  "external_id": "T1091",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:08.977Z",
  "modified": "2025-10-24T17:48:40.752Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement",
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "Windows Malware Infecting Android",
      "url": "https://www.computerworld.com/article/2486903/windows-malware-tries-to-infect-android-devices-connected-to-pcs.html"
    },
    {
      "source_name": "iPhone Charging Cable Hack",
      "url": "https://techcrunch.com/2019/08/12/iphone-charging-cable-hack-computer-def-con/"
    },
    {
      "source_name": "Exploiting Smartphone USB ",
      "url": "https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.226.3427&rep=rep1&type=pdf"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0143 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00b0af92-df59-4d56-ac3e-18f6f1f72957

Kaspersky Flame

ATTACK:enterprise:S0028 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--114f98a4-6243-4a0c-a6c4-3e693a4f9b08

ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--155b3e76-eaf8-4b4c-95b6-7836a6c81f76

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b91f271-feb7-4abe-b1c1-ffee0bceedfd

SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ca27813-cdc2-4d3c-a3db-d18f1de9c697

DOJ Affidavit Search and Seizure PlugX December 2024

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--242a60b4-114e-4dc5-9577-72dfd375a93c

Bitdefender LuminousMoth July 2021 · Kaspersky LuminousMoth July 2021

ATTACK:enterprise:S0130 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--291df761-474b-4c5f-a9bd-2aaef0f80d70

Forcepoint Monsoon

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f337593-16b2-40a2-928c-c7659d0326ea

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3eb29574-145d-4d4a-b4c6-e94b8a79781e

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2682dc-f64d-482b-8fc4-132dad2727d9

Cisco H1N1 Part 2

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2d2786-1ccb-41d9-90dc-4e11d517bfe2

Microsoft Disable Autorun · TechNet Removable Media Control

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bad7b38-36b5-4208-9895-e4a113c511a3

Kaspersky Darkhotel

ATTACK:enterprise:M1034 → mitigates → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c245d0b-61e7-4558-8b36-32c846266af0

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fccce48-b648-40e4-a58a-18f068189daf

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65df5b73-98b5-474d-8ee4-0b60b7291712

Avira Mustang Panda January 2020

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66810009-f426-4cee-8514-21d00753ae7a

TrendMicro RaspberryRobin 2022 · RedCanary RaspberryRobin 2022

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74a7cfb9-2b2a-44c2-b5ea-0327fe9e17e9

ATTACK:enterprise:S0092 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f3c015e-d95d-4d35-a583-236134464554

ThreatExpert Agent.btz

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--815fff92-274f-467c-a8c0-a623588c6739

Fidelis njRAT June 2013 · Trend Micro njRAT 2018

ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93bea600-6a8d-4f58-acf3-e7d604eeb451

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9aeda7e2-e452-4cd3-837f-e258cba1fc96

Microsoft SIR Vol 19 · FireEye APT28 · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e70e248-2335-45ba-ae58-b162bc6b9bf4

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7697490-b9ad-45b9-9e69-ddc4a7a6d94c

Gemini_FIN7_Jan2022 · FBI Flash FIN7 USB

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8f639f8-9717-485a-ad4c-7eb1fc771691

Eset Ramsay May 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc3ca652-5f6f-4d8b-8b3d-51ab6f776e8a

Trend Micro Qakbot May 2020

ATTACK:enterprise:S1074 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce1bc121-5337-4be7-b363-f94a22ca10dc

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3e841fa-b806-4c22-9f98-a97950b68931

ESET Sednit USBStealer 2014

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edaf0203-4959-4e1e-9240-3d20cf0f3b6a

Microsoft SIR Vol 19

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f308adef-2601-41b2-9da8-b785a7adf06c

SANS Conficker · Trend Micro Conficker

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc0432e9-1b49-4be8-b86e-15cdec6b070e

TrendMicro Ursnif File Dec 2014 · TrendMicro Ursnif Mar 2015

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fded4f08-6cb0-4259-a6a9-f0d62537164f

TrendMicro Tropic Trooper May 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.