MITRE ATT&CK Technique
T1052.001Exfiltration over USB
- First Reported
- Oct 21, 2026
- Latest Reported
- Oct 21, 2026
Official Description
Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.(Citation: A USB data exfiltration case study)
- Tactics
- Exfiltration
- Platforms
- Linux, Windows, macOS
- Parent Technique
- T1052 · Exfiltration Over Physical Medium
- MITRE Version
- 1.3
- Last Modified
- Sep 2, 2026
Reported Context (1)
- Attackers copied stolen data onto removable media, including thumb drives. IBM's 2026 Breach Report Puts Average Cost at $4.99 Million as AI-Driven Attacks Rise
MITRE ATT&CK (6)
Industries (5)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.