Procedure examples

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.

During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.

For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.

During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.

During the 2025 Poland Wiper Attacks, threat actors leveraged the FortiGate VPN interface that was exposed to the internet to gain access to the victim environment.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.

During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.

During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.