A drive on the ground. A connection in under six minutes.
That’s how quickly the first drive was connected in a 2016 university field study.
Researchers dropped 297 USB drives around a campus, including parking lots. People picked them up, connected them, and opened files—sometimes to help find the owner. These were research devices, not a live malware attack. The lesson is about how quickly trust becomes a connection.
Portable media can carry malware and ransomware between computers, within your organization and beyond. Screen it before the next connection.
CURRENT REPORTING · THREE SECURITY INDUSTRY PERSPECTIVES · 2026
The case for checking first.
Portable media is part of today’s security conversation. These 2026 articles explain why physical connections still deserve a deliberate screening step—even as organizations invest in cloud and endpoint protection.
CrowdStrike
Published
“one physical channel presents an ongoing risk: removable media.”
CrowdStrike’s 2026 analysis describes USB-borne campaigns active through 2025, including malware that uses portable devices to establish access and deliver further payloads. Its central point: cloud adoption has not removed the physical route into a computer. Removable media still brings both intrusion and data-loss risks.
Why check first? A drive’s next connection is a practical place to add a screening checkpoint, alongside the protection already running on the computer.
“While isolation can reduce exposure, it doesn't eliminate risk.”
In its October 2026 expert discussion, Honeywell challenges the assumption that disconnected systems are automatically secure. Its experts identify USB drives and third-party devices as paths into sensitive environments, and recommend following screening procedures before devices reach the local network.
Why check first? A protected network still needs a process for the media people bring to it. Put screening into the everyday transfer workflow.
“scan removable media on a dedicated isolated system prior to connecting it to any corporate network.”
Graham Cluley’s June 2026 article reports on counterfeit USB drives used in Japanese military networks during 2024–2025, citing a Nikkei Asia investigation. The reported drives reached more than 50 computers. The malware was described as self-replicating; confirmed data theft was not established.
Why check first? Risk is not limited to drives found in a parking lot. Newly supplied media also deserves verification before use on a protected computer.
A mailed package. A shared drive. A transfer between isolated systems. Portable media gives threats a physical route between computers.
FIN7 · FBI WARNING DOCUMENTED BY HHS · 2022
The attack arrived in the mail.
HHS documented an FBI warning about FIN7 mailing malicious USB devices to businesses, including defense, transportation, and insurance targets. An ordinary-looking delivery can carry a deliberately prepared device.
Microsoft connected Raspberry Robin’s USB-spread infections with follow-on activity in the ransomware ecosystem. The first infected computer can become a foothold for a larger intrusion.
Mandiant documented USB-delivered espionage campaigns across industries. SNOWYDRIVE also copied malicious components onto other drives attached to an infected computer—illustrating why screening belongs before the next connection.
unique USB threats detected through Honeywell SMX · Q1 2025
INDUSTRIAL USB THREATS · HONEYWELL · 2025
Real media. Real environments.
Honeywell reported 1,826 unique USB threats in its SMX telemetry for Q1 2025. This describes Honeywell’s observed dataset, showing that portable-media threats remain a practical concern in industrial operations.
Your network has a perimeter. Portable media needs a checkpoint.
Small and portable, DF-X1 provides standalone threat screening and a tamper-evident chain-of-custody record. Place units across desks, departments, and floors to make screening part of everyday practice.
Use it alongside endpoint protection, device controls, and your organization’s handling procedures. Review the result and any coverage limits before connecting the media elsewhere.
