# T1025 Data from Removable Media > As of 2026-10-05, T1025 (Data from Removable Media) appears in 17 tracked threats, first reported 2026-02-16 and most recently 2026-07-31, with linked actors including APT37, Gamaredon, Gamaredon Group; it most often appears alongside T1005 (Data from Local System). - **Tracked threats:** 17 (16 high, 1 medium) - **First seen:** 2026-02-16 - **Last seen:** 2026-07-31 - **Threat actors:** 11 - **Detection rules:** 6 (counts only; Blue tier and above) ## Key facts - **ID:** T1025 - **Framework:** MITRE ATT&CK - **Tactics:** Collection - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1025/ ## Activity timeline T1025 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-07-31. The busiest month was 2026-07 with 9 reports, and 17 of the 17 threats were reported in the twelve months to 2026-07. ## How adversaries use it T1025 Data from Removable Media is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 17 of 2623 tracked threats (0.6%) to it; by severity that is 16 high, 1 medium. Threats that use T1025 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (14 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (14 threats), [T1102 Web Service](https://intel.threadlinqs.com/technique/T1102) (13 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (13 threats), [T1083 File and Directory Discovery](https://intel.threadlinqs.com/technique/T1083) (12 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1025; the most frequent are [APT37](https://intel.threadlinqs.com/actor/APT37) (4), [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) (4), [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) (2), [APT36](https://intel.threadlinqs.com/actor/APT36) (1), [APT44](https://intel.threadlinqs.com/actor/APT44) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1025. - [M1057 Data Loss Prevention](https://attack.mitre.org/mitigations/M1057/) ## Data sources Telemetry that can reveal T1025, per MITRE ATT&CK. - Command — Command Execution - File — File Access ## Threat actors using it - [APT37](https://intel.threadlinqs.com/actor/APT37) — 4 - [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) — 4 - [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) — 2 - [APT36](https://intel.threadlinqs.com/actor/APT36) — 1 - [APT44](https://intel.threadlinqs.com/actor/APT44) — 1 - [Cavern Manticore](https://intel.threadlinqs.com/actor/Cavern%20Manticore) — 1 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 1 - [Contagious Interview - G1052](https://intel.threadlinqs.com/actor/Contagious%20Interview%20-%20G1052) — 1 - [RomCom](https://intel.threadlinqs.com/actor/RomCom) — 1 - [Transparent Tribe](https://intel.threadlinqs.com/actor/Transparent%20Tribe) — 1 - [Turla](https://intel.threadlinqs.com/actor/Turla) — 1 ## Tracked threats 17 tracked threats use T1025. - [OctLurk and SilkLurk Backdoors: Unattributed Chinese-Speaking Actor Cyberespionage Campaign Targeting…](https://intel.threadlinqs.com/threat/TL-2026-1783) — high — 2026-07-31 - [HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…](https://intel.threadlinqs.com/threat/TL-2026-1553) — high — 2026-07-20 - [UAC-0145 (Sandworm/APT44, GRU) Uses ClickFix Fake-CAPTCHA Lures and EtherHiding to Deploy Multi-Stage…](https://intel.threadlinqs.com/threat/TL-2026-1527) — high — 2026-07-19 - [Forbidden Hyena Adopts AI-Generated BlackReaperRAT and Milkyway (Blackout Locker) Ransomware in Telegram-C2…](https://intel.threadlinqs.com/threat/TL-2026-1496) — high — 2026-07-18 - [Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domains](https://intel.threadlinqs.com/threat/TL-2026-1484) — medium — 2026-07-18 - [Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)](https://intel.threadlinqs.com/threat/TL-2026-1450) — high — 2026-07-18 - [Turla (Snake/Uroburos) Exploits SharePoint Flaw to Breach French Justice-Sector Server](https://intel.threadlinqs.com/threat/TL-2026-1268) — high — 2026-07-13 - [Counterfeit China-Made USB Drives with Self-Replicating Malware Infect 50+ Japan Ground Self-Defense Force…](https://intel.threadlinqs.com/threat/TL-2026-1240) — high — 2026-07-11 - [Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…](https://intel.threadlinqs.com/threat/TL-2026-1210) — high — 2026-07-11 - [Russian APT Gamaredon Upgrades Arsenal with Six New PowerShell Downloaders, Cloudflare/Devtunnel C2…](https://intel.threadlinqs.com/threat/TL-2026-0968) — high — 2026-06-28 - [ScarCruft (APT37) Deploys Python-Based NarwhalRAT via Fake Microsoft Account Security Alerts and LNK-in-ZIP…](https://intel.threadlinqs.com/threat/TL-2026-0890) — high — 2026-06-20 - [NarwhalRAT: APT37-Linked Python RAT Deployed via Fake Microsoft OTP-Abuse Alerts Against South Korean Targets](https://intel.threadlinqs.com/threat/TL-2026-1525) — high — 2026-06-15 - [NarwhalRAT: APT37 Python-based RAT delivered via LNK/PowerShell/Python loader chain in Microsoft-themed…](https://intel.threadlinqs.com/threat/TL-2026-0802) — high — 2026-06-15 - [Russia-aligned Gamaredon (Earth Dahu) and UAC-0226 (SHADOW-EARTH-066) Exploit Patched WinRAR Path-Traversal…](https://intel.threadlinqs.com/threat/TL-2026-0723) — high — 2026-06-09 - [Gamaredon (Russia/FSB) "GammaWorm" — VBScript Worm Hidden in NTFS ADS with Cloud-Service Dead Drop Resolver…](https://intel.threadlinqs.com/threat/TL-2026-0653) — high — 2026-06-02 - [APT37 Ruby Jumper Campaign — Air-Gapped Network Bridging via THUMBSBD USB Worm, RESTLEAF Zoho WorkDrive C2…](https://intel.threadlinqs.com/threat/TL-2026-0150) — high — 2026-02-27 - [APT36/Transparent Tribe Deploys Crimson RAT and CapraRAT for India-Targeted Multi-Platform Espionage](https://intel.threadlinqs.com/threat/TL-2026-0106) — high — 2026-02-16 ## Related CVEs CVEs referenced by the tracked threats that use T1025, most frequent first. - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) ## Detection coverage Threadlinqs maintains 6 detection rules mapped to T1025 (SPL 2, KQL 3, Sigma 1). Rule content is available to Blue tier accounts and above; this page shows counts only. 6 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1025 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)