A transit malware investigation shows the sample spread when technicians reused an infected USB stick for bus-garage diagnostic laptops. Which concept does that illustrate?

Propagation vectors describe how malware moves from one host to another. In a transit malware investigation where the sample spread because technicians reused an infected USB stick across bus-garage diagnostic laptops, the illustrated concept is removable-media propagation—physical media carrying the infection between systems that may not share continuous network trust. OT-adjacent municipal garage environments commonly reuse diagnostic sticks; labeling that vector correctly steers hardening toward media controls, host USB policy, scanning stations, and technician workflow changes rather than unrelated controls.

In-memory fileless execution fails because that concept emphasizes scarce on-disk artifacts and RAM-resident code, not physical USB transfer between garage laptops. Authenticated vulnerability scanning of OT controllers fails because scanning methodology is an authorized assessment activity, not a malware spread path observed in the investigation. WMI event-subscription persistence on domain controllers fails because persistence keeps malware alive on a host across restarts; the stem is about how infection jumped between diagnostic systems via USB, not how it survived reboot on a DC.

Exam caveat: do not confuse propagation (how it spreads) with persistence (how it stays), delivery lure content, or assessment tooling. Civic transit stems often highlight USB and shared-drive realities that differ from purely network worm narratives.

Operational check for transit SOC/IR: quarantine the implicated USB media, image or hash known-bad sticks, inventory which garage diagnostic laptops mounted them, scan and rebuild affected hosts as policy requires, enforce allow-listed or scanned media workflows, and brief technicians so reuse of untrusted sticks stops before the next maintenance window.