T1091 - Replication Through Removable Media is a mitre_attack tracked by ThreatCluster, appearing in 9 threat clusters built from 13 intelligence report mentions.
T1091 - Replication Through Removable Media is a mitre_attack tracked across 9 threat clusters and 13 intelligence report mentions on ThreatCluster. First observed March 27, 2026; most recent activity June 27, 2026.
The Gamaredon group, a Russian-aligned APT, has significantly upgraded its cyber capabilities in 2025, focusing on spear-phishing campaigns against Ukrainian targets. ESET Research reports that Gamaredon conducted 35…
Japan's Ground Self-Defense Force unknowingly used counterfeit USB drives embedded with malware linked to Chinese hackers for nearly a year. The incident came to light after personnel noticed abnormal computer…
ZionSiphon is a newly discovered malware designed to target Israeli water treatment and desalination systems. It is capable of manipulating hydraulic pressures and chlorine levels to potentially sabotage operations. The…
In 2025, multiple China-linked threat groups executed a sophisticated cyber campaign against a Southeast Asian government, utilizing various malware families to achieve persistent access and exfiltrate sensitive data.…
Between June and August 2025, a coordinated cyberespionage operation targeted a Southeast Asian government organization. Attackers deployed USB-propagated malware, including a variant named USBFect (also known as…
The Silent Ransom Group has been implicated in a series of cyberattacks targeting US law firms, employing operatives to physically access computers and insert USB devices. This tactic aims to bypass remote security…
A new malware strain named 'DeepLoad' has been identified, capable of stealing credentials from enterprise networks immediately upon infection. The malware employs AI-generated code to obfuscate its logic, making it…
Microsoft has identified a new cryptocurrency-stealing malware named Crypto Clipper, active since February 2026. This malware spreads primarily through malicious Windows shortcut files (.lnk) on USB drives, targeting…
A new variant of the PlugX USB worm is causing infections across multiple continents, utilizing DLL sideloading and USB-based propagation techniques to remain undetected. Initially identified in Papua New Guinea in…
T1091 - Replication Through Removable Media is a mitre_attack tracked by ThreatCluster, appearing in 9 threat clusters built from 13 intelligence report mentions.
The most recent intelligence report mentioning T1091 - Replication Through Removable Media on ThreatCluster is dated June 27, 2026. Activity was first observed March 27, 2026, giving a tracked span from then to June 27, 2026.
Across ThreatCluster reporting, T1091 - Replication Through Removable Media most frequently co-occurs with Crimson Palace, Earth Estries, Gamaredon, InvisiMole, Mustang Panda, among 12 tracked related entities.
The most significant recent cluster is “Gamaredon APT Escalates Cyber Operations Against Ukraine in 2025” (7 articles · Updated June 25, 2026). T1091 - Replication Through Removable Media appears across 9 threat clusters in total, listed above with sources.
T1091 - Replication Through Removable Media appears in 13 intelligence report mentions across 9 deduplicated threat clusters, aggregated from 17,000+ monitored sources.