T1091: Replication Through Removable Media (The core propagation mechanism using autorun.inf)
Operational Executive Summary
T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf)) is classified under the Lateral Movement tactic within the MITRE ATT&CK framework. Methods used to extend access to additional remote systems and compute nodes within an enterprise network via SMB/RPC, Windows Remote Management, and RDP sessions. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 56 distinct malware families, totaling over 60,187 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Replication Through Removable Media (The core propagation mechanism using autorun.inf) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Replication Through Removable Media (The core propagation mechanism using autorun.inf), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1091 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Replication Through Removable Media (The core propagation mechanism using autorun.inf) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1091/.
Detection Engineering & Threat Hunting
Detecting Replication Through Removable Media (The core propagation mechanism using autorun.inf) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Replication Through Removable Media (The core propagation mechanism using autorun.inf) across adjacent network segments.
Cataloged Malware Families Utilizing T1091 (56 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1091 (Replication Through Removable Media (The core propagation mechanism using autorun.inf)):
56 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| sality | File Infector | 18,572 | Sality is one of the most durable, resilient, and historically significant polymorphic file infectors and botnets in cybersecurity history. First identified aro... |
| sivis | File Infector | 7,180 | Sivis (known across antivirus vendors as Win32.Sivis or W32/Sivis) is a classic Windows PE file infector that first surfaced around 2006. Engineered during the ... |
| wapomi | Worm Banker | 5,191 | Wapomi (widely documented by antivirus laboratories as Virus.Wapomi or Otwycal) is a parasitic polymorphic PE file infector and worm that first surfaced in 2010... |
| vobfus | Worm | 1,484 | Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and trojan loader developed... |
| wabot | Rat | 1,185 | Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for co... |
| lamer | Worm | 894 | Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a ... |
| mira | Worm | 729 | Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm a... |
| ainslot | Trojan | 635 | Trojan:Win32/Ainslot (also cataloged in threat telemetry as Worm:Win32/Ainslot.A, TROJ_GEN.UAE171Y, or Win32/Ainslot) is a persistent Windows trojan dropper and... |
| vbclone | Trojan | 601 | VBClone (identified across security telemetry as Trojan:Win32/VBClone!rfn, Trojan.VBClone, and Win32/VBClone) represents a widely distributed family of Visual B... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| sfone | Worm | 332 | Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Windows worm and trojan loade... |
| ludbaruma | Worm | 283 | Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows ... |
| sytro | Worm | 273 | Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) network worm and download... |
| pluto | Worm | 209 | Pluto (identified in security intelligence under signatures including Worm:Win32/Pluto, Trojan:Win32/Pluto, W32.Pluto, and Worm.Win32.Pluto) is a hybrid Windows... |
| drolnux | Worm | 205 | Drolnux (tracked in antivirus telemetry as Worm:Win32/Drolnux, Worm:Win32/Drolnux.A, and W32/Drolnux) is a network-aware computer worm and backdoor trojan that ... |
| pioneer | File Infector | 203 | Pioneer (identified across antivirus engines as Virus:Win32/Pioneer.A, Virus.Win32.Pioneer, and PE_PIONEER) is an advanced 32-bit Windows Portable Executable (P... |
| viking | File Infector | 175 | Viking (cataloged across security vendors as Virus:Win32/Viking, Worm.Win32.Viking, and PE_VIKING) is an infamous and highly destructive hybrid file-infecting v... |
| beebone | Worm | 151 | Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified i... |
| rebhip | Rat | 120 | Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network... |
| phorpiex | Botnet | 115 | Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-funct... |
| ngrbot | Worm | 110 | NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-pr... |
| rbot | Backdoor | 109 | Rbot (widely cataloged across vendor telemetry as Backdoor:Win32/Rbot, W32.Spybot, Worm:Win32/Rbot, and RxBot) is one of the most prolific and historically sign... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| propagate | Ransomware | 67 | Worm:Win32/Propagate is a behavioral heuristic detection utilized by antivirus engines to flag malware that aggressively attempts to copy itself across a networ... |
| brontok | Worm | 57 | Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing com... |
| tenga | File Infector | 50 | Tenga (cataloged across antivirus vendors under signatures including Virus:Win32/Tenga, Win32/Tenga.A, and Virus.Win32.Gat.a) is a landmark polymorphic file inf... |
| mofksys | Worm | 14 | Mofksys (classified as Worm:Win32/Mofksys across Microsoft Defender, Sophos, and Kaspersky) is an evasive network and removable drive worm targeting Windows sys... |
| conficker | Worm | 11 | Conficker (also known as Downadup or Kido) is one of the most prolific, destructive, and technologically advanced computer worms in internet history, first disc... |
| sohanad | Trojan | 11 | Worm:Win32/Sohanad is a widespread, classic computer worm that gained notoriety for spreading aggressively via removable drives (USB flash drives) and popular I... |
| fakefolder | Ransomware | 7 | Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily... |
| grenam | Advanced Threat | 7 | Worm:Win32/Grenam (also known as a generic network worm or **File Infector**) is a self-replicating malware family that aggressively spreads across network shar... |
| kido | Advanced Threat | 5 | Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in h... |
| rontokbr | Advanced Threat | 5 | Worm:Win32/Rontokbr (also widely known as **Rontokbro** or Brontok) is a classic, highly pervasive computer worm that first surged in the mid-2000s. It was famo... |
| jenxcus | Trojan | 4 | Worm:VBS/Jenxcus (often referred to as Houdini or Dinihu) is a prolific, script-based worm and Remote Access Trojan (RAT) written entirely in Visual Basic Scrip... |
| sillysharecopy | Advanced Threat | 4 | Worm:Win32/Sillysharecopy is a heuristic detection name for a rudimentary, heavily repackaged class of computer worms that propagate primarily by copying themse... |
| krepper | Trojan | 3 | Worm:Win32/Krepper is a highly virulent, self-replicating network worm designed to spread rapidly across vulnerable corporate environments. Unlike a trojan that... |
| taterf | Advanced Threat | 3 | Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playi... |
| autorunerent | Trojan | 2 | Autorunerent (classified in antivirus detection telemetry under designations including Trojan:Win32/Autorunerent, Trojan.Win32.Autorunerent, and Win32/Autoruner... |
| gamaredon | Trojan | 2 | Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (... |
| sillyfdc | Advanced Threat | 2 | Worm:Win32/Sillyfdc is a prolific and persistent worm designed to propagate rapidly across networks by infecting removable drives (USB flash drives). First emer... |
| slenfbot | Advanced Threat | 2 | Worm:Win32/Slenfbot is a highly infectious network worm and botnet agent notorious for its aggressive self-propagation methods. Once executed on a host, it imme... |
| vjworm | Backdoor | 2 | Worm:VBS/Vjworm (and its variants like JS/Vjworm) is a highly aggressive, self-propagating worm written in scripting languages (Visual Basic Script or JavaScrip... |
| cridex | Trojan | 1 | <h3>Executive Summary</h3> Cridex is a highly influential banking trojan and worm that emerged in 2011, notorious for being the direct predecessor to the devast... |
| fire | Ransomware | 1 | <h3>Executive Summary</h3> Fire (often detected generically as Virus.Win32.Fire or Trojan.Fire) represents an older class of malicious software that exhibits cl... |
| fosniw | Ransomware | 1 | <h3>Executive Summary</h3> Fosniw is a hybrid threat that combines the persistence and payload delivery mechanisms of a Trojan with the rapid propagation capabi... |
| hamweq | Ransomware | 1 | <h3>Executive Summary</h3> Hamweq (often associated with the extensive IRCBot or AutoRun worm families) is a self-replicating malicious Worm and Botnet agent. D... |
| imaut | Ransomware | 1 | <h3>Executive Summary</h3> Imaut (often referred to as Worm.Imaut or AutoRun.Imaut) is a prolific family of legacy worms that primarily spread via removable med... |
| mupx | Trojan | 1 | <h3>Executive Summary</h3> Mupx is a malicious threat that combines the persistence and self-replication capabilities of a network worm with the payload deliver... |
| otorunq | Trojan | 1 | <h3>Executive Summary</h3> Otorunq is a network worm and trojan that utilizes the legacy Windows `autorun.inf` feature for aggressive lateral movement and propa... |
| pyme | Ransomware | 1 | <h3>Executive Summary</h3> Pyme is a malicious program that exhibits characteristics of both a Trojan and a Worm. It is designed to covertly infiltrate Windows ... |
| ramnif | Trojan | 1 | <h3>Executive Summary</h3> Ramnif is a heavily obfuscated alias and variant of the notorious **Ramnit** malware family. Originally discovered in 2010 as a self-... |
| silly | Ransomware | 1 | <h3>Executive Summary</h3> Silly (often referred to as SillyFDC or Worm.Silly) is a prolific family of legacy worms that primarily spread via removable media, m... |
| taworm | Ransomware | 1 | Worm:Win32/Taworm is a self-replicating malware strain designed to spread rapidly across networks and removable media without requiring user interaction beyond ... |
| vtub | Advanced Threat | 1 | <h3>Executive Summary</h3> Vtub is a malicious network worm designed to propagate rapidly across local area networks (LANs) and removable media. While it freque... |