Skip to content

Data from Removable Media

Technique · ATTACK:enterprise:T1025

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1025",
  "title": "Data from Removable Media",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1025",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1b7ba276-eedc-4951-a762-0ceea2c030ec",
  "external_id": "T1025",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:31.584Z",
  "modified": "2025-10-24T17:48:28.431Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [

  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00ae99d1-db02-4007-8669-04d7fc4c1390

ESET Sednit USBStealer 2014 · Kaspersky Sofacy

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--077beadb-aa94-45bd-8875-d917fcd7f6b7

ESET InvisiMole June 2020

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2995ea85-ccdb-4378-bc35-3c62ccf5fa9d

CheckPoint Naikon May 2020

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46396855-3e2e-428e-95b6-1888007fd393

Symantec Crambus OCT 2023

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50b2e4e3-8740-463b-87fc-e96c4b62fbe5

CheckPoint Volatile Cedar March 2015

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565da748-a5c8-417c-8c55-828c6e9f2c35

Talos GravityRAT

ATTACK:enterprise:S0090 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d87588e-2202-4616-a536-e43a2606721b

Palo Alto Rover

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74e09d88-36e4-4332-9a25-3d5f19db1bfb

ESET EvasivePanda 2023

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--788e8246-d835-42c6-b8b4-7efad31e4a84

ESET Gamaredon June 2020 · Palo Alto Gamaredon Feb 2017 · ESET Gamaredon Sept2024

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78e8d9e6-48b7-473f-af94-43f626de7931

Microsoft SIR Vol 19

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e7ff07b-7a32-4ced-ac22-b523586dbde3

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93fc3086-d2c0-4b4d-8a69-278f15176739

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96e928af-dbfc-4743-a1dc-353904e21fd3

ESET Operation Groundbait

ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97cfa5ec-e6b6-40cc-b73c-283f4a5d8ded

ESET Crutch December 2020

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ab576ed-2ba0-4fc5-87fc-2011a7cd183d

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cba53fd-9b5c-4dc3-b933-c167b1d62a03

Cylance Machete Mar 2017 · ESET Machete July 2019

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab3599ae-66cd-49c2-bfa7-cbec9af6e271

Talos Oblique RAT March 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad2efb21-6884-422f-8e89-fc0b1d2dcbb0

ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cad9bdcc-41b3-44e2-98d2-fb07fe268838

Kaspersky TajMahal April 2019

ATTACK:enterprise:M1057 → mitigates → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d92971eb-3ac4-4019-bbb3-dec4a2c6cb18

ATTACK:enterprise:S0036 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e30a790b-8f09-4bdc-8116-275d00880333

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e465cb38-ba50-4d2d-b2cd-659742815317

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e4cb23-3c58-41d8-9583-9e10bff2b1d0

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f86c19e6-39a1-423c-8db2-a8258ac51bd6

Eset Ramsay May 2020

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff61ebde-befe-488a-89d0-dc4c49e60d59

F-Secure Cosmicduke

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.