Gamaredon USB Propagation: autorun.inf and File Copy to Removable Media

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects the creation or modification of potentially malicious files such as autorun.inf or scripts (.lnk, .vbs, .hta, .bat, .cmd, .ps1) on removable or network drive letter paths (D-Z). This activity is indicative of attempts to facilitate malware execution via removable media, bypassing standard system binaries by excluding Microsoft-signed processes.