Ultimately, there are actually multiple ways malware can spread through removable media:
Windows Autorun functionality.
Years back, when new software primarily came in the form of physical installation media, Microsoft decided that users shouldn't need to hunt through directory listings to find the installer when they put the media into their computer, and as a result, Autorun was born.
In short, if you have Autorun enabled (all consumer Windows systems do by default), whenever you connect some form of removable media to the system (be it a floppy disk, a CD, a DVD, a flash drive, or even something really exotic like a ZIP disk or Thunderbolt storage device), Windows will look for a file called
autorun.inf in the top-level directory of the media. This file, if present, can do a number of interesting things. The simplest (and most common use) is to just change the icon for the removable media (usually to match whatever product it contains the installer for). However, it can also make Windows run a specific executable off of the media either when you try to open the media by double clicking the icon, or completely automatically. The most common legitimate use for this these days is USB devices which need special drivers (when you connect it, it looks like a USB flash drive to the system, which sees the Autorun file, which in turn points to an installer for the drivers for the device), but such devices are increasingly rare.
Because Windows doesn't always prompt the user about what to do with the Autorun file, and on top of that most users just click through without thinking (and even if they tell it not to run anything, it may still do so if they manually double click the icon for the media), this is a very popular vector for malware to spread.
Other OSes also have similar functionality, although it's usually turned off by default (or at least, not as trivially exploitable as the Windows Autorun functionality).
Malicious filesystem images.
This one is a bit more technical. Essentially, by carefully manipulating the filesystem on a device (often by hand with a hex editor), it's theoretically possible to exploit bugs in the filesystem drivers of the OS to do any number of things. This can be used to hide files from the user (making the above exploit harder to detect), or just to attack the system directly through some exploit in the drivers. This is not commonly exploited by most malware, but it's also really easy to do with some practice.
Malicious device firmware.
Even rarer than the other two possibilities, it'st technically possible for the firmware on a storage device to directly attack the system itself. This can be used to produce results like either of the above two options, or just attack some other part of the OS involved with interfacing with the storage device directly. This is almost exclusively limited to highly targeted attacks because pulling it off from software on an already infected system ranges from 'insanely hard' to functionally impossible', and is almost certainly not what happened here.