Skip to content

T1219 Remote Access Software

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, AnyDesk, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.3

Remote access tools may be installed and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. Installation of many remote access tools may also include persistence (ex: the tool’s installation routine creates a Windows Service).

Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns.12

Item Value
ID T1219
Sub-techniques
Tactics TA0011
Platforms Linux, Windows, macOS
Version 2.1
Created 18 April 2018
Last Modified 21 April 2022

Procedure Examples

ID Name Description
C0015 C0015 During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.31
C0018 C0018 During C0018, the threat actors used AnyDesk to transfer tools between systems.3029
S0030 Carbanak Carbanak has a plugin for VNC and Ammyy Admin Tool.7
G0008 Carbanak Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.14
G0080 Cobalt Group Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.222324
G0105 DarkVishnya DarkVishnya used DameWare Mini Remote Control for lateral movement.21
S0384 Dridex Dridex contains a module for VNC.6
S0554 Egregor Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.4
G0120 Evilnum EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.27
G0115 GOLD SOUTHFIELD GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool “ConnectWise Control” to deploy REvil.19
S0601 Hildegard Hildegard has established tmate sessions for C2 communications.5
G0094 Kimsuky Kimsuky has used a modified TeamViewer client as a command and control channel.2526
G0069 MuddyWater MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.1718
G0129 Mustang Panda Mustang Panda has installed TeamViewer on targeted systems.11
C0002 Night Dragon During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.28
S0148 RTM RTM has the capability to download a VNC module from command and control (C2).8
G0048 RTM RTM has used a modified version of TeamViewer and Remote Utilities for remote access.13
G0034 Sandworm Team Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.1615
G0139 TeamTNT TeamTNT has established tmate sessions for C2 communications.520
G0076 Thrip Thrip used a cloud-based remote access software called LogMeIn for their attacks.12
S0266 TrickBot TrickBot uses vncDll module to remote control the victim machine.910

Mitigations

ID Mitigation Description
M1038 Execution Prevention Use application control to mitigate installation and use of unapproved software that can be used for remote access.
M1037 Filter Network Traffic Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access tools.
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Connection Creation
DS0009 Process Process Creation

References

  1. CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018. ↩

  2. CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018. ↩

  3. Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018. ↩

  4. Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020. ↩

  5. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩↩

  6. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019. ↩

  7. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  8. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. ↩

  9. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021. ↩

  10. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021. ↩

  11. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021. ↩

  12. Security Response Attack Investigation Team. (2018, June 19). Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies. Retrieved July 10, 2018. ↩

  13. Skulkin, O. (2019, August 5). Following the RTM Forensic examination of a computer infected with a banking trojan. Retrieved May 11, 2020. ↩

  14. Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016. ↩

  15. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. ↩

  16. US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020. ↩

  17. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. ↩

  18. Mele, G. et al. (2021, February 10). Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies. Retrieved March 17, 2021. ↩

  19. Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved December 14, 2020. ↩

  20. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  21. Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020. ↩

  22. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. ↩

  23. Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018. ↩

  24. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. ↩

  25. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019. ↩

  26. Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. ↩

  27. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021. ↩

  28. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018. ↩

  29. Costa, F. (2022, May 1). RaaS AvosLocker Incident Response Analysis. Retrieved January 11, 2023. ↩

  30. Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023. ↩

  31. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩