A maintenance technician walks up to an engineering workstation with a USB drive that holds a controller patch. The vendor emailed the file that morning. The drive has been in three different laptops this month. Nobody scans it, because the network is "air-gapped" and the job is urgent. Eight seconds later, the file is on a machine that talks to every PLC on the line.

This scene plays out thousands of times a day across factories, refineries, water plants and power stations. It is mundane, which is exactly why it is dangerous. Removable media is the quiet route into the most protected parts of industrial networks, and it works because it exploits something no firewall can fix: people need to move files to keep plants running.

This Blog explains how USB-based attacks really unfold in operational technology (OT), what past incidents teach us, why antivirus alone is not enough, and how a modern media scan and secure file approval process closes the gap without slowing your teams down. If you run an OT security program, an industrial site, or a security operations center that supports one, this is written for you.

Why USB Remains One of the Most Persistent Threats in Industrial Networks

Industrial control systems were built for uptime and safety, not for the connected world they now sit in. Many controllers, HMIs and engineering stations run for ten, fifteen, sometimes twenty-plus years. They often cannot be patched on a normal schedule, cannot run modern endpoint agents, and sit in zones where connecting to the internet is rightly forbidden.

That isolation creates a practical problem. Firmware updates, ladder logic backups, vendor tools, historian exports, configuration files and diagnostic software all have to get in and out somehow. In a large share of plants, the answer is still a USB stick, an external hard drive or a laptop plugged in by a contractor.

The air gap is thinner than most leaders believe

True air gaps are rare. Even where there is no cable to the corporate network, there are still humans, vendors and portable devices crossing the boundary every week. A network that has no digital path in but has a physical path through a USB port is not isolated. It is simply unmonitored.

Attackers know this. Malware designed for industrial environments often needs no command-and-control connection at all. It rides in on a drive, does its work offline, and waits for the next drive to carry data out.

Why operational reality keeps USB alive

• Legacy equipment: older Windows-based engineering stations and embedded devices frequently have no other practical input method.

• Vendor and contractor access: third-party engineers arrive with their own laptops, tools and drives, often after working at several other sites.

• Shift pressure: when a line is down, speed wins over procedure unless the safe path is also the fast path.

• Remote and unmanned sites: substations, pumping stations and wind farms rely on field visits where media is the easiest way to move data.

• Weak visibility: many sites cannot say how many removable devices were connected to critical assets last month.

Real Incidents That Show What a Single USB Drive Can Do

Removable media attacks are not theoretical. They have shaped some of the most important events in industrial security history, and they keep recurring in new forms.

Stuxnet: the attack that rewrote the rulebook

Discovered in 2010, Stuxnet is widely reported to have reached an air-gapped uranium enrichment facility in Iran through infected removable drives. It used multiple previously unknown vulnerabilities, including a Windows shortcut-file flaw that allowed code to run simply by opening a drive in a file explorer. Once inside, it searched for specific Siemens controllers, quietly altered their logic, and is reported to have damaged around a thousand centrifuges while showing operators normal readings. The lesson was clear: isolation does not protect a plant if a trusted person can carry the payload across the boundary.

Agent.btz: a USB worm that reached military networks

In 2008, a worm known as Agent.btz spread through removable drives and infiltrated sensitive U.S. military networks. The response, widely described as one of the most significant of its kind, led to a department-wide ban on removable media for a period and a major rethink of how portable devices are controlled. It showed that even highly secured environments can be reached by a very basic delivery method.

Power generation sites hit by infected drives

In 2012, U.S. industrial security authorities reported two incidents at power generation facilities caused by malware on USB drives. At one site, a contractor used an infected drive to run a software update on a turbine control workstation. The result was roughly three weeks of delayed restart for that unit while the environment was cleaned. No attacker had to break through a firewall. A routine maintenance task was enough.

Raspberry Robin: USB worms in the modern era

First observed around 2021, Raspberry Robin spreads through infected USB devices that carry malicious shortcut files. Security researchers have linked it to later access and ransomware activity against organizations in several sectors, including manufacturing and telecommunications. It is a reminder that USB propagation is not an old technique. It is a proven delivery method that criminal groups still use because it works.

Table 1: Notable USB-borne incidents and what each one teaches OT security teams

How USB-Based Attacks Actually Unfold in OT Environments

Understanding the path of an attack makes it far easier to place the right controls. Most removable media incidents follow a pattern, even when the malware itself is different each time.

Figure 1: The typical path of a USB-borne attack into an industrial control environment

Stage 1: Infection outside the plant

The drive gets infected somewhere uncontrolled: a home computer, a vendor laptop, a trade show kiosk, a printer in a shared office. Often nobody knows. The user is not careless. They simply have no way to tell.

Stage 2: Physical transport across the boundary

The device is carried into the site by an employee, contractor or visiting engineer. Perimeter defenses never see it, because it never touches the network until the final step.

Stage 3: Execution on a trusted machine

Once plugged into an engineering workstation or HMI, malware can run automatically through shortcut files, autorun behavior, malicious documents or disguised executables. Engineering stations are especially valuable targets because they hold the credentials, project files and software used to program controllers.

Stage 4: Spread and persistence

From that first machine, the code moves laterally to historians, SCADA servers and other Windows hosts, and may copy itself onto every new drive that is inserted. This is how one infected device can contaminate many sites over time.

Stage 5: Operational impact

The consequences range from nuisance to severe: data theft of process recipes and designs, ransomware that encrypts operator screens, tampered controller logic, or unplanned shutdowns. In industrial settings, the worst outcomes are physical, including safety events and equipment damage.

The Business Impact: What Is Really at Stake

Security leaders sometimes struggle to explain removable media risk to executives because the entry point looks so trivial. The better conversation is about what happens after the drive is plugged in.

Table 2: How a removable media incident translates into business risk

Recovery is usually more expensive than prevention for a simple reason: in OT, you cannot always restart, reimage or patch quickly. Restoring a trusted state often means validating every affected device by hand.

Why Traditional Antivirus and Policy Alone Fall Short

Most plants already have some kind of rule about USB use. Many also run endpoint protection on certain systems. Yet incidents continue, for understandable reasons.

A policy without enforcement is a suggestion

A written rule that says "scan all media before use" depends on every person remembering, every time, under pressure. Without a simple, mandatory path, exceptions become habits. Auditors may see a policy. Attackers see a gap.

Single-engine scanning misses too much

No single detection engine catches everything. New or modified threats routinely evade one vendor's signatures for hours or days. Relying on one scanner, often one that was last updated weeks ago on an offline machine, leaves a meaningful window of exposure.

Detection is not the same as prevention

Malware detection answers the question, "Do we recognize something bad here?" It does not answer, "Is this file safe to deliver to a controller?" Documents and archives can carry hidden scripts, macros, embedded objects or exploit code that no signature has seen before. Zero-day content passes straight through detection-only checks.

Endpoint agents are not always possible

Many OT assets cannot run modern endpoint software because of vendor restrictions, performance concerns or unsupported operating systems. Protection has to happen before the file reaches those assets.

Blocking every port is not realistic

Some organizations respond by disabling USB entirely. That works until a vendor needs to push a patch or an engineer needs a backup. Teams then find workarounds, which are usually less secure than the original process. The goal is not to stop file transfer. The goal is to make file transfer controlled, visible and safe.

From Malware Detection to Secure File Approval: A Modern Control Model

The most effective programs treat every external file as untrusted until it has passed through a defined sequence of checks. That sequence is more than a scan. It is a managed workflow that combines inspection, sanitization, human approval and record keeping.

Figure 2: A six-step secure file approval workflow for OT sites

Step 1: Request and declare

Before a file moves, the person states what it is, why it is needed and where it is going. This simple step creates accountability and gives the approver context. A firmware update for a specific controller is a very different request from an unlabelled folder of documents.

Step 2: Multi-layer media scanning

A dedicated media scan station, sometimes called a kiosk or sheep-dip station, checks every drive and file in an isolated environment before it goes anywhere near production. A strong scan combines several elements:

• Multiple independent malware detection engines to reduce the chance that a single blind spot lets a threat through.

• Checks for known vulnerabilities and suspicious behavior in executables and installers.

• Inspection of the device itself, since some malicious USB hardware pretends to be a keyboard or other trusted device rather than storage.

• File type verification to catch executables disguised as documents.

Step 3: File sanitization

Sanitization, often called content disarm and reconstruction, goes a step beyond detection. Instead of asking whether a file looks malicious, it rebuilds the file from known-good components and removes active content such as macros, scripts and embedded objects that the file does not need to do its job. The result is a clean file that is functionally equivalent for the user and far harder to weaponize. This is the control that addresses unknown threats.

Step 4: Policy-based approval

Not every file deserves the same level of scrutiny. A mature process applies rules based on file type, source, destination zone and sensitivity. Routine low-risk files can be approved automatically after a clean scan. Controller firmware, engineering project files or anything going to a safety-related system should require review by a named owner who understands the process impact.

Step 5: Controlled delivery

Approved files are delivered only to the intended destination, ideally through a one-way or tightly controlled transfer path rather than by returning the original drive to the user. This prevents the original, unclean media from being plugged in later.

Step 6: Logging and alerting

Every action should leave a record: who brought the file, what was found, who approved it, and where it went. These records matter for incident response, compliance evidence and continuous improvement. Repeated blocks from the same source or contractor are often the earliest sign of a larger problem upstream.

Table 3: Comparing common approaches to removable media control

Sector Perspectives: Where the Risk Looks Different

The core threat is the same everywhere, but how it shows up depends on the environment. Tailoring controls to the sector makes them easier to adopt and more effective.

Energy and utilities

Generation plants, substations and water facilities often operate across wide geographies with small on-site teams. Technicians travel between locations carrying the same drive, which turns one infection into a multi-site problem. Unmanned sites make physical port control and pre-visit scanning especially important, and regulators in this sector increasingly expect evidence that portable media is governed.

Manufacturing

Factories mix modern lines with older machines, and production data, recipes and design files move constantly between engineering, quality and suppliers. The biggest exposure is usually the sheer volume of file transfers, so automation of scanning and approval for low-risk files is essential. Otherwise the process either collapses under its own weight or gets bypassed.

Oil, gas, chemicals and process industries

Here the consequence of a bad change to controller logic can be physical and immediate. Stricter approval tiers, named owners for safety-related files and tested offline backups matter most, because the cost of an error is measured in more than lost production.

Transportation and logistics

Rail, ports and airports depend on a large ecosystem of contractors and equipment suppliers who service operational systems on site. Clear third-party device rules and site-owned media for routine work can remove much of the risk without slowing service windows.

Practical Best Practices for OT Teams

Technology matters, but programs succeed when they fit how plants actually operate. These recommendations reflect what tends to work in the field.

Figure 3: Layered defense protects the control layer even when one layer fails

Make the secure path the easy path

If scanning adds twenty minutes of friction, people will skip it. Place scan stations where people already enter the site, keep the process short, and give technicians clear feedback. When the safe way is also the fast way, compliance rises without enforcement drama.

Control ports by zone, not by blanket rule

• Disable USB storage on assets that do not need it, including many operator stations and servers.

• Allow only approved, registered devices on engineering workstations that genuinely require media.

• Use physical port locks or tamper-evident seals for critical cabinets and unmanned sites.

Treat vendors and contractors as part of your attack surface

Third-party laptops and drives are among the highest-risk items entering a plant. Require every external device to pass through the same scan and approval path as employee media, and consider issuing site-owned, labelled drives for routine transfers. Agree on these expectations in contracts, not at the gate on the day of the job.

Harden the endpoints that must accept media

• Turn off autorun and autoplay features everywhere.

• Use application allow-listing so only approved software can execute, even if a malicious file lands on disk.

• Keep engineering stations in their own network segment with tightly limited connectivity.

• Maintain tested offline backups of controller logic and project files so recovery does not depend on the suspect machine.

Monitor for removable media activity

Visibility closes the loop. Security operations teams should be able to see when unapproved devices are connected, when scan results come back positive, and when files move toward critical zones. Feeding this data into existing monitoring gives analysts early warning rather than a post-incident surprise.

Train people with real scenarios

Short, practical training works better than annual slide decks. Show technicians what an infected drive looks like in practice, explain why a familiar vendor can still be a risk, and make it easy to report a mistake without blame. Teams that feel safe reporting problems catch them sooner.

A 90-Day Roadmap to Reduce Removable Media Risk

You do not need a multi-year program to make progress. A focused ninety days can reduce exposure significantly.

Table 4: A phased plan for implementing media scan and secure file approval

Metrics worth tracking

• Percentage of removable media entering sites that passes through the approved scan path.

• Number of threats and policy violations blocked per month, by site and source.

• Average time from file request to approved delivery.

• Number of critical assets with USB storage disabled or tightly controlled.

Questions Every OT Security Leader Should Be Able to Answer

If you cannot answer these confidently today, you have found your starting point.

1. How many removable devices connected to critical assets in the last 30 days, and who owned them?

2. Is every external file, including vendor patches, scanned and sanitized before reaching a controller or engineering station?

3. Who approves files bound for safety-related or high-consequence systems?

4. Can we prove to an auditor or regulator exactly what entered a given site last quarter?

5. What happens if a contractor arrives with an unscanned laptop during a shutdown window?

6. Can we restore controller logic from a trusted offline backup within the time our operations can tolerate?

How Shieldworkz Supports Organizations

Shieldworkz works with industrial operators, manufacturers and critical infrastructure organizations that need security measures that respect how plants really run. Our approach pairs deep OT and ICS experience with practical, site-ready programs. We help you reduce removable media risk without adding friction that operators will work around.

• Removable media risk assessment: We map how files and devices actually move into and out of your sites, identify the riskiest workflows and ports, and give you a prioritized plan.

• Media scan and secure file approval design: We help you define approval tiers, zone-based policies and roles so the process matches your operations, safety requirements and regulatory obligations.

• Deployment and integration support: From pilot site to enterprise rollout, we support implementation of scan stations, sanitization and transfer controls, and connect them with your existing monitoring.

• Contractor and third-party access strategy: We build practical requirements for vendor devices, site-owned media and access procedures that work during shutdowns and urgent repairs.

• Endpoint and network hardening for PLC and SCADA environments: We help you segment engineering stations, apply allow-listing and protect legacy assets that cannot run modern agents.

• Threat intelligence and monitoring: We turn removable media events into actionable alerts for your security operations center, supported by current industrial threat insight.

• Training and incident readiness: We deliver scenario-based exercises for engineers, operators and response teams, so people know what to do when something looks wrong.

Whether you are building a program from scratch or strengthening one that already exists, our specialists will meet you where you are and focus on the risks that matter most to your operation.

Frequently Asked Questions

Are air-gapped networks safe from USB attacks?

No. An air gap removes the network path but not the human one. Several of the most significant industrial incidents on record reached isolated systems through removable media. Isolation helps, but only when paired with strict control of every file and device that crosses the boundary.

What is the difference between malware scanning and file sanitization?

Scanning looks for threats it recognizes. Sanitization rebuilds the file without active or unnecessary content, so even a threat nobody has seen before is neutralized. The strongest programs use both.

Should we simply disable all USB ports?

Disabling ports on assets that do not need them is a smart step. Blocking everything, however, often drives teams to unsafe workarounds. A controlled, approved path for the files you must move is more reliable over time.

How does this apply to vendor-supplied updates?

Vendor files should be treated like any other external content. A trusted source can still deliver a compromised file through an infected laptop, a hijacked account or a tampered download. Scan, sanitize and approve every update before it reaches a controller.

Conclusion

USB-based attacks endure because they exploit the gap between security design and operational reality. Plants must move files, and attackers know that every drive is a potential bridge. The answer is not to ban the drive or to trust the scan alone. It is to build a controlled, visible and fast process in which every external file is inspected, sanitized, approved and recorded before it reaches the systems that run your operation.

Organizations that make this shift gain more than protection. They gain evidence for regulators and customers, calmer maintenance windows, and confidence that a single drive will not decide the fate of a shift.

Additional resources:

Incident Response Plan for Municipal & Wastewater Utilities here
What Is Removable Media? Risks, Policies, and Industrial OT Security Solutions here
Free Removable Media Policy Template for OT and IT Teams here
Remediation Guides here