Consider the threat model for a moment. You have an airgapped machine, users who use that airgapped machine, and data that must get loaded onto the airgapped ma

Consider the threat model for a moment. You have an airgapped machine, users who use that airgapped machine, and data that must get loaded onto the airgapped machine through some means. You need to land your malware on the machine so you need to understand the security posture of it to tailor proper evasions and which also align to your goals. Can you run with a simple recompiled Mimikatz or do you need to craft a custom multi-stage post-exploitation toolkit? The malware needs to be deployed via existing trusted means of data transfer so you need to understand what that trust model is and search for weaknesses you may exploit. Is data transfer as simple as plugging in a USB stick or are there multiple gating functions like signature verification, etc on adjacent systems before you can move to the primary? The data transfer is usually executed by a human being who must plug in some media with your malware on it either wittingly or unwittingly. The former requires working that human as an asset over a long term blackmail or HUMINT campaign. The latter involves compromising the supply chain that ends with executables being copied to the media vector. These are concentric circles of controls between you and that airgap - but each has a weakness. There are entire agencies and organizations who live, breath, and execute targeted searches for those weaknesses. So yes, in my opinion these are real threats IF an adversary that has the capability, time, and funding to perform the above falls within your organization's threat model.