Procedure examples

BlackByte has used tools such as AnyDesk in victim environments.

TeamTNT has established tmate sessions for C2 communications.

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.

DarkVishnya used DameWare Mini Remote Control for lateral movement.

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.

INC Ransom has used AnyDesk and PuTTY on compromised systems.

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.

ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.