Skip to content

T1219 Remote Access Tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.512 Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.

Installation of many remote access tools may also include persistence (e.g., the software’s installation routine creates a Windows Service). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).34

Item Value
ID T1219
Sub-techniques T1219.001, T1219.002, T1219.003
Tactics TA0011
Platforms Linux, Windows, macOS
Version 3.0
Created 18 April 2018
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G1024 Akira Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.3738
G1043 BlackByte BlackByte has used tools such as AnyDesk in victim environments.3940
S0030 Carbanak Carbanak has a plugin for VNC and Ammyy Admin Tool.8
G0008 Carbanak Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.32
G0080 Cobalt Group Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.414243
G0105 DarkVishnya DarkVishnya used DameWare Mini Remote Control for lateral movement.29
S0384 Dridex Dridex contains a module for VNC.6
S0554 Egregor Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.16
G0046 FIN7 FIN7 has utilized the remote management tool Atera to download malware to a compromised system.19
G0115 GOLD SOUTHFIELD GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool “ConnectWise Control” to deploy REvil.20
S0601 Hildegard Hildegard has established tmate sessions for C2 communications.11
G1032 INC Ransom
INC Ransom has used AnyDesk and PuTTY on compromised systems.24232122
S1245 InvisibleFerret InvisibleFerret has utilized remote access software including AnyDesk client through the “adc” module.121315 InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for C:/Program Files(x86)/AnyDesk/AnyDesk.exe.14
G1051 Medusa Group Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration.25262728 Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.26
G0069 MuddyWater MuddyWater has used legitimate applications ScreenConnect, AteraAgent and SimpleHelp to manage systems remotely and move laterally.35333436
C0002 Night Dragon During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.44
G0049 OilRig OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.18
S0148 RTM RTM has the capability to download a VNC module from command and control (C2).7
G0034 Sandworm Team Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.3130
G0139 TeamTNT TeamTNT has established tmate sessions for C2 communications.1117
S0266 TrickBot TrickBot uses vncDll module to remote control the victim machine.910

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.
M1038 Execution Prevention Use application control to mitigate installation and use of unapproved software that can be used for remote access.
M1037 Filter Network Traffic Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.
M1034 Limit Hardware Installation Block the use of IP-based KVM devices within the network if they are not required.
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.

References

  1. CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018. ↩

  2. CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018. ↩

  3. Google. (n.d.). Retrieved March 14, 2024. ↩

  4. Huntress. (n.d.). Retrieved March 14, 2024. ↩

  5. Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018. ↩

  6. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019. ↩

  7. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. ↩

  8. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. ↩

  9. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021. ↩

  10. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021. ↩

  11. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. ↩↩

  12. eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025. ↩

  13. Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025. ↩

  14. Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025. ↩

  15. Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025. ↩

  16. Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020. ↩

  17. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022. ↩

  18. Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024. ↩

  19. Abdo, B., et al. (2022, April 4). FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7. Retrieved April 5, 2022. ↩

  20. Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024. ↩

  21. Carvey, H. (2024, May 1). LOLBin to INC Ransomware. Retrieved June 5, 2024. ↩

  22. SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024. ↩

  23. SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024. ↩

  24. Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024. ↩

  25. Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025. ↩

  26. Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025. ↩↩

  27. Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025. ↩

  28. Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025. ↩

  29. Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020. ↩

  30. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. ↩

  31. US-CERT. (2016, February 25). ICS Alert (IR-ALERT-H-16-056-01) Cyber-Attack Against Ukrainian Critical Infrastructure. Retrieved June 10, 2020. ↩

  32. Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016. ↩

  33. Mele, G. et al. (2021, February 10). Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies. Retrieved March 17, 2021. ↩

  34. Miller, J. et al. (2024, March 21). Security Brief: TA450 Uses Embedded Links in PDF Attachments in Latest Campaign. Retrieved March 27, 2024. ↩

  35. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. ↩

  36. Rostovcev, N. (2023, April 18). SimpleHarm: Tracking MuddyWater’s infrastructure. Retrieved July 11, 2024. ↩

  37. Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024. ↩

  38. Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024. ↩

  39. Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024. ↩

  40. Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024. ↩

  41. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018. ↩

  42. Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018. ↩

  43. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018. ↩

  44. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018. ↩