USB Drop Attack

What Is USB Drop Attack?

Attackers leave infected drives in parking lots, lobbies and break rooms, labeled with something you will want to read. Curiosity does the rest. In this exercise you find one marked with salary data, plug it in, wave away the antivirus warning, and enable macros in a spreadsheet. Ransomware encrypts every file within seconds. You then take the machine off the network and report what happened. The better response was simpler: leave the drive alone and hand it to security.

What You'll Learn in USB Drop Attack

• Recognize USB drop attacks as a deliberate social engineering technique that exploits human curiosity and the desire to be helpful
• Follow the correct response protocol for found USB devices: do not connect, do not inspect contents, report to IT security immediately
• Explain how a document on a found drive can run malicious code the moment you enable its macros
• Identify high-risk locations where USB drop attacks are commonly staged, including parking lots, lobbies, conference rooms, and shared spaces
• Support organizational removable media policies including USB port restrictions, endpoint detection alerts, and approved device registries

USB Drop Attack — Training Steps

1. A Morning Discovery

   It's Tuesday morning. Alice grabs her coffee and heads to her home office to start the workday. On her way through the apartment building lobby, something catches her eye on the floor near the mailboxes. A sleek black USB drive with an official-looking label: 'CONFIDENTIAL - Q4 Salary Review - HR ONLY'

2. The Temptation

   Alice picks up the drive, curiosity piqued. Someone from her building must work at her company - or maybe a competitor? She knows she should turn it in to IT, but... 'I'll just check what's on it first,' she thinks. 'If it's really HR data, I should verify it's ours before handing it over.'

3. Antivirus Warning

   Windows recognizes the USB drive. The file explorer opens, showing several files: Q4_Salary_Review_2024.xlsm Employee_Performance_Rankings.pdf Compensation_Adjustments.docx Suddenly, an antivirus warning pops up - the system has detected suspicious content on the drive.

4. Opening the File

   Alice dismisses the warning, convinced it's a false positive. The salary spreadsheet is right there, promising answers to questions everyone whispers about. She double-clicks the Excel file. The .xlsm ending means a macro-enabled workbook; a plain .xlsx cannot carry macros at all. It opens with a security warning: 'Macros have been disabled.' The content is hidden behind a message asking to enable macros.

5. The Encryption

   The moment Alice clicks 'Enable Content,' the malicious macro executes. A command prompt window flashes briefly on screen. The hard drive starts churning. Within seconds, ransomware silently encrypts every file on her computer - documents, photos, projects, everything.

6. Checking Her Files

   Something feels wrong. Alice's computer seems sluggish, and the hard drive is still churning. A cold knot forms in her stomach. She rushes to check her important work documents - the quarterly report she's been working on for weeks.

7. The Ransom Demand

   Instead of her quarterly report, a terrifying ransom screen appears. A glowing red lock icon. A countdown timer. A demand for 0.5 Bitcoin. Every single file on her computer - documents, photos, projects - has been encrypted by ransomware. The attackers are demanding payment to unlock her data.

8. Immediate Response

   Alice's heart sinks as she realizes the severity of the situation. All her files - work projects, personal documents, everything - are now encrypted and held hostage. She remembers from security training: the first priority is to stop the malware from spreading to other devices on the network. Unplugging the network and leaving the machine running is best, because memory can hold evidence. Her workstation connects over Wi-Fi only, with no cable to pull, and the ransom note has locked her screen, so powering off is the only way left to cut it off.

9. Damage Control

   Alice powers off her PC, the fallback when a machine cannot be taken off the network any other way, to stop the ransomware spreading further. She remembers from security training: isolate first, ask questions later. She moves to her second workstation, which never touched the USB drive, to report the incident. The security team needs to know about this immediately.

10. Filing the Report

    Alice opens the security incident report form. Complete honesty is crucial - even though she made a mistake, reporting quickly can limit the damage. She documents everything: where she found the USB, what she did with it, and the ransomware infection.