1. Home
  2. Techniques
  3. Enterprise
  4. 从可移动介质获取数据

从可移动介质获取数据

从可移动介质获取数据是指攻击者通过已控制的系统读取连接在主机上的移动存储设备，收集敏感信息用于后续攻击活动。传统检测方法侧重于监控文件系统访问日志、分析进程命令行参数，以及检测可疑的外部设备连接事件。防御措施包括限制可移动介质使用权限、部署设备控制策略，以及监控自动化收集工具的行为特征。

现有匿迹技术的核心逻辑围绕设备信任模型突破与数据操作时空特征重塑展开：固件层攻击直接颠覆硬件设备的功能可信基，在物理层面实现数据过滤；合法工具滥用技术则利用系统组件的功能正当性，将恶意操作伪装成合规管理行为；延迟外传机制通过分离数据采集与传输阶段，规避实时监控系统的关联分析。这些技术的共性在于突破传统安全防护的层次化防御假设，通过硬件、系统、应用层的协同隐匿，使得单一维度的安全控制措施难以有效检测。攻击者特别注重操作节奏与目标环境运维特征的匹配，例如在系统维护窗口期执行高负载操作，或利用设备固件的合法更新周期植入恶意代码。

ID: T1025
Sub-techniques:  No sub-techniques
ⓘ
Tactic: 信息收集
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
System Requirements: Privileges to access removable media drive and files
Contributors: William Cain
Version: 1.2
Created: 31 May 2017
Last Modified: 15 October 2024

匿迹效应

效应类型 是否存在
特征伪装 ✅
行为透明 ❌
数据遮蔽 ✅
时空释痕 ✅

特征伪装

攻击者通过精确复现系统管理工具的操作特征实现行为伪装。例如使用PowerShell脚本调用WMI接口获取介质信息时，严格遵循系统管理员的典型命令参数格式，使恶意进程在命令行审计中呈现为合法管理活动。固件层攻击则通过模拟标准设备的协议交互过程，在硬件识别层面维持正常特征。

数据遮蔽

在数据暂存和传输阶段采用分片加密机制，每个数据块使用独立密钥进行AES-256加密，并与系统文件交叉存储。加密密钥通过隐写术嵌入驱动程序或注册表项，使得即便发现存储内容也无法直接解密完整数据集。

时空释痕

延迟外传技术将数据窃取过程分解为长周期、多阶段的离散操作。攻击者利用系统维护周期或设备常规使用时段执行关键操作，使得单次行为强度低于检测阈值，同时通过跨设备、跨时区的数据聚合进一步稀释行为特征浓度。

Procedure Examples

ID Name Description
S0622 AppleSeed

AppleSeed can find and collect data from removable media devices.[1][2]
G0007 APT28

An APT28 backdoor may collect the entire contents of an inserted USB device.[3]
S0456 Aria-body

Aria-body has the ability to collect data from USB devices.[4]
S0128 BADNEWS

BADNEWS copies files with certain extensions from USB devices toa predefined directory.[5]
S0050 CosmicDuke

CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.[6]
S0115 Crimson

Crimson contains a module to collect data from removable drives.[7][8]
S0538 Crutch

Crutch can monitor removable drives and exfiltrate files matching a given extension list.[9]
S0569 Explosive

Explosive can scan all .exe files located in the USB drive.[10]

S0036 FLASHFLOOD

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.[11]
S1044 FunnyDream

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.[12]
G0047 Gamaredon Group

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.[13][14]
S0237 GravityRAT

GravityRAT steals files based on an extension list if a USB drive is connected to the system.[15]
S0260 InvisiMole

InvisiMole can collect jpeg files from connected MTP devices.[16]
S0409 Machete

Machete can find, encrypt, and upload files from fixed and removable drives.[17][18]

S1146 MgBot

MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.[19]
S0644 ObliqueRAT

ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.[20]
S0113 Prikormka

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.[21]
S0458 Ramsay

Ramsay can collect data from removable media and stage it for exfiltration.[22]

S0125 Remsec

Remsec has a package that collects documents from any inserted USB sticks.[23]
S0090 Rover

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.[24]
S0467 TajMahal

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.[25]
G0010 Turla

Turla RPC backdoors can collect files from USB thumb drives.[26][27]
S0136 USBStealer

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.[28][29]

Mitigations

ID Mitigation Description
M1057 Data Loss Prevention

Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that could be taken to collect files from a system's connected removable media. For example, data may be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.
DS0022 File File Access

Monitor for unexpected/abnormal file accesses to removable media (optical disk drive, USB memory, etc.) connected to the compromised system.

References

  1. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  2. KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.
  3. Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
  4. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  5. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  6. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  7. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  8. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  9. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
  10. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.
  11. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  12. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  13. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  14. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  15. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  1. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  2. The Cylance Threat Research Team. (2017, March 22). El Machete's Malware Attacks Cut Through LATAM. Retrieved September 13, 2019.
  3. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  4. Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.
  5. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
  6. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  7. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  8. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  9. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.
  10. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  11. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  12. Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
  13. Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
  14. Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.