# How can ransomware spread through a USB stick or external drive?

In two ways. A drive can carry the malware itself, which runs when someone opens a disguised file, and some malware copies itself onto every drive it finds so that it travels between computers and sites. And a drive that is connected when encryption starts is simply encrypted with everything else, which is why a backup on a permanently attached USB disk does not protect you from ransomware. Disable automatic running of programs from removable media, scan unknown drives on a dedicated computer, allow only company-issued devices where you can, and disconnect backup drives after each run. Spain's INCIBE has published a real case in which ransomware spread as infected devices were connected. A USB transfer does not cross the network, so a network sensor does not see it; NetSenX sees what the infected computer does next, such as scanning or calling an outside server.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)
- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)
- [Should we hire an incident-response firm or handle an incident ourselves?](https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves)
- [How do we tell customers what data was affected in a breach?](https://netsenx.com/en/faq/how-to-tell-customers-what-data-was-affected)
- [Can network evidence show that a specific customer's data did not leave?](https://netsenx.com/en/faq/can-network-evidence-show-a-customers-data-did-not-leave)