Remote Access Software

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.^[6][7]

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.^[8]

During C0018, the threat actors used AnyDesk to transfer tools between systems.^[9][10]

During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.^[11]

Carbanak has a plugin for VNC and Ammyy Admin Tool.^[12]

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.^[13]

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.^[14][15][16]

DarkVishnya used DameWare Mini Remote Control for lateral movement.^[17]

Dridex contains a module for VNC.^[18]

Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.^[19]

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.^[20]

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.^[21]

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.^[22]

Hildegard has established tmate sessions for C2 communications.^[23]

INC Ransom has used AnyDesk and PuTTY on compromised systems.^{[24][25][26][27]}

Kimsuky has used a modified TeamViewer client as a command and control channel.^[28][29]

MuddyWater has used legitimate applications ScreenConnect, AteraAgent and SimpleHelp to manage systems remotely and move laterally.^{[30][31][32][33]}

Mustang Panda has installed TeamViewer on targeted systems.^[34]

During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.^[35]

RTM has the capability to download a VNC module from command and control (C2).^[36]

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.^[37]

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.^[38][39]

During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.^[11]

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including AnyDesk, LogMeIn, and ConnectWise Control to establish persistence on the compromised network.^[40][41]

TeamTNT has established tmate sessions for C2 communications.^[23][42]

Thrip used a cloud-based remote access software called LogMeIn for their attacks.^[43]

TrickBot uses vncDll module to remote control the victim machine.^[44][45]

Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

Use application control to mitigate installation and use of unapproved software that can be used for remote access.

Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.

Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.