Skip to content

T1133 External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.2

Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.1 Access to remote services may be used as a redundant or persistent access mechanism during an operation.

Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.63

Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool ShadowLink to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because ShadowLink sets up a .onion address on the compromised system. ShadowLink may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.5 Adversaries may get ShadowLink to persist on a system by masquerading it as an MS Defender application.4

Item Value
ID T1133
Sub-techniques
Tactics TA0003, TA0001
Platforms Containers, Linux, Windows, macOS
Version 2.5
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
C0028 2015 Ukraine Electric Power Attack During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.54
G1024 Akira Akira uses compromised VPN accounts for initial access to victim networks.47
G0026 APT18 APT18 actors leverage legitimate credentials to log into external remote services.16
G0007 APT28 APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.48
G0016 APT29 APT29 has used compromised identities to access networks via VPNs and Citrix.3433
G0096 APT41 APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.24
C0046 ArcaneDoor ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.61
C0027 C0027 During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.58
C0032 C0032 During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.59
G0114 Chimera Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.4344
C0004 CostaRicto During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.55
S0600 Doki Doki was executed through an open Docker daemon API port.11
G0035 Dragonfly Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.4546
G1003 Ember Bear Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.15
G1016 FIN13 FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).14
G0053 FIN5 FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.363738
G0093 GALLIUM GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.2829
G0115 GOLD SOUTHFIELD GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.42
S0601 Hildegard Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.3
G0004 Ke3chang Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.3031
G0094 Kimsuky Kimsuky has used RDP to establish persistence.35
S0599 Kinsing Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.10
G1004 LAPSUS$ LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix. 2625
G0065 Leviathan Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.51
S0362 Linux Rabbit Linux Rabbit attempts to gain access to the server via SSH.8
S1060 Mafalda Mafalda can establish an SSH connection from a compromised host to a server.9
C0002 Night Dragon During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.53
G0049 OilRig OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.27
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}.52
C0014 Operation Wocao During Operation Wocao, threat actors used stolen credentials to connect to the victim’s network via VPN.60
G1040 Play
Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.4950
G0034 Sandworm Team Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company’s users.18191720
G1015 Scattered Spider Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.23
G1041 Sea Turtle Sea Turtle has used external-facing SSH to achieve initial access to the IT environments of victim organizations.41
C0024 SolarWinds Compromise For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.5756
G0139 TeamTNT TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.1312 TeamTNT has also targeted exposed kubelets for Kubernetes environments.3
G0027 Threat Group-3390 Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.39 Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.40
G1047 Velvet Ant Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.22
G1017 Volt Typhoon Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.21
G0102 Wizard Spider Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.32

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Disable or block remotely available services that may be unnecessary.
M1035 Limit Access to Resource Over Network Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
M1032 Multi-factor Authentication Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary’s ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.
M1030 Network Segmentation Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
M1021 Restrict Web-Based Content Restrict all traffic to and from public Tor nodes. 7

References

  1. Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017. ↩

  2. Apple Support. (n.d.). Set up a computer running VNC software for Remote Desktop. Retrieved August 18, 2021. ↩

  3. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩↩↩

  4. Microsoft Threat Intelligence. (2023, December 7). Russian threat actors dig in, prepare to seize on war fatigue. Retrieved June 18, 2025. ↩

  5. Microsoft Threat Intelligence. (2025, February 12). The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation. Retrieved June 18, 2025. ↩

  6. Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021. ↩

  7. CISA, FBI. (2020, July 1). Defending Against Malicious Cyber Activity Originating from Tor . Retrieved June 20, 2025. ↩

  8. Anomali Labs. (2018, December 6). Pulling Linux Rabbit/Rabbot Malware Out of a Hat. Retrieved March 4, 2019. ↩

  9. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. ↩

  10. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021. ↩

  11. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. ↩

  12. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  13. Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021. ↩

  14. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023. ↩

  15. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. ↩

  16. Adair, S. (2017, February 17). Detecting and Responding to Advanced Threats within Exchange Environments. Retrieved November 17, 2024. ↩

  17. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021. ↩

  18. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020. ↩

  19. Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020. ↩

  20. Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024. ↩

  21. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  22. Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025. ↩

  23. CrowdStrike. (2023, January 10). SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security. Retrieved July 5, 2023. ↩

  24. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩

  25. Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022. ↩

  26. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  27. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017. ↩

  28. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019. ↩

  29. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021. ↩

  30. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  31. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩

  32. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020. ↩

  33. Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023. ↩

  34. National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020. ↩

  35. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. ↩

  36. Scavella, T. and Rifki, A. (2017, July 20). Are you Ready to Respond? (Webinar). Retrieved October 4, 2017. ↩

  37. Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017. ↩

  38. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017. ↩

  39. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩

  40. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. ↩

  41. Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024. ↩

  42. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020. ↩

  43. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.. ↩

  44. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. ↩

  45. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  46. CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021. ↩

  47. Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024. ↩

  48. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  49. CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024. ↩

  50. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024. ↩

  51. CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021. ↩

  52. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩

  53. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018. ↩

  54. Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024. ↩

  55. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. ↩

  56. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  57. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021. ↩

  58. Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023. ↩

  59. Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019. ↩

  60. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  61. Canadian Centre for Cyber Security. (2024, April 24). Cyber Activity Impacting CISCO ASA VPNs. Retrieved January 6, 2025. ↩