Sub-technique of T1219 Remote Access Tools.View on attack.mitre.org
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.
Rules on DetectionCode tagged with T1219.002.
| Used by | Procedure example |
|---|---|
| GroupContagious Interview | Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities. ESET Contagious Interview BeaverTail InvisibleFerret February 2025Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024SecurityScorecard Contagious Interview October 2024 |
| GroupEvilnum | EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines. |
| GroupKimsuky | Kimsuky has used a modified TeamViewer client as a command and control channel. |
| GroupMuddyWater | MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration. |
| GroupMustang Panda | Mustang Panda has installed TeamViewer on targeted systems. |
| GroupRTM | RTM has used a modified version of TeamViewer and Remote Utilities for remote access. |
| GroupScattered Spider | In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network. |
| GroupStorm-0501 | Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io. |
| Used by | Procedure example |
|---|---|
| MalwareQilin | Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems. |
| Used by | Procedure example |
|---|---|
| CampaignC0015 | During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network. |
| CampaignC0018 | During C0018, the threat actors used AnyDesk to transfer tools between systems. |
| CampaignC0027 | During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
