MITRE ATT&CK Technique
T1025Data from Removable Media
- First Reported
- Jun 14, 2026
- Latest Reported
- Jun 14, 2026
Official Description
Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.
Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on removable media.
- Tactics
- Collection
- Platforms
- Linux, macOS, Windows
- MITRE Version
- 1.3
- Last Modified
- Oct 24, 2025
Reported Context (1)
- The usb2local: command collected files from USB and removable storage using xcopy. Genians Details NarwhalRAT Campaign Using Microsoft-Themed Phishing and Dead-Drop C2
Malware (2)
Threat Actors (1)
MITRE ATT&CK (29)
Vendors (1)
Products (4)
Tools (5)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.