Replication Through Removable Media

Technique · ATTACK:ics:T0847

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:T0847",
  "title": "Replication Through Removable Media",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0847",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21",
  "external_id": "T0847",
  "domain": "ics",
  "created": "2020-05-21T17:43:26.506Z",
  "modified": "2026-10-13T17:48:36.055Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "BBC April 2016",
      "url": "https://www.bbc.com/news/technology-36158606"
    },
    {
      "source_name": "Catalin Cimpanu April 2016",
      "url": "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
    },
    {
      "source_name": "Christoph Steitz, Eric Auchard April 2016",
      "url": "https://www.reuters.com/article/us-nuclearpower-cyber-germany/german-nuclear-plant-infected-with-computer-viruses-operator-says-idUSKCN0XN2OS"
    },
    {
      "source_name": "Dark Reading Staff April 2016",
      "url": "https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298"
    },
    {
      "source_name": "ESET April 2016",
      "url": "https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/"
    },
    {
      "source_name": "Kernkraftwerk Gundremmingen April 2016",
      "url": "https://www.kkw-gundremmingen.de/presse.php?id=571"
    },
    {
      "source_name": "Lee Mathews April 2016",
      "url": "https://web.archive.org/web/20160430041256/https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/"
    },
    {
      "source_name": "Peter Dockrill April 2016",
      "url": "https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant"
    },
    {
      "source_name": "Sean Gallagher April 2016",
      "url": "https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/"
    },
    {
      "source_name": "Trend Micro April 2016",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/malware-discovered-in-german-nuclear-power-plant"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.