Malware
USBCulprit
According to Kaspersky, USBCulprit is a malware that is capable of scanning various paths in victim machines, collecting documents with particular extensions and passing them on to USB drives when the
USBCulprit is a Windows malware family operated by Hellsing.
Background
Kaspersky reports that USBCulprit can scan a range of paths on victim machines, gather documents matching specific extensions, and offload them to USB drives once those drives are attached. It can also conditionally copy itself onto a removable drive when a certain file is present, which implies it can move laterally by infecting chosen drives and relying on someone manually running the executable they carry.
Source: Malpedia (Fraunhofer FKIE).