Remote Access Tools

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.^[6][7]

BlackByte has used tools such as AnyDesk in victim environments.^[8][9]

Carbanak has a plugin for VNC and Ammyy Admin Tool.^[10]

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.^[11]

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.^[12][13][14]

DarkVishnya used DameWare Mini Remote Control for lateral movement.^[15]

Dridex contains a module for VNC.^[16]

Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.^[17]

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.^[18]

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.^[19]

Hildegard has established tmate sessions for C2 communications.^[20]

INC Ransom has used AnyDesk and PuTTY on compromised systems.^{[21][22][23][24]}

InvisibleFerret has utilized remote access software including AnyDesk client through the "adc" module.^[25][26][27] InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for C:/Program Files(x86)/AnyDesk/AnyDesk.exe.^[28]

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration.^{[29][30][31][32]} Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.^[30]

MuddyWater has used legitimate applications ScreenConnect, AteraAgent and SimpleHelp to manage systems remotely and move laterally.^{[33][34][35][36]}

During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.^[37]

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.^[38]

RTM has the capability to download a VNC module from command and control (C2).^[39]

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.^[40][41]

TeamTNT has established tmate sessions for C2 communications.^[20][42]

TrickBot uses vncDll module to remote control the victim machine.^[43][44]

Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

Use application control to mitigate installation and use of unapproved software that can be used for remote access.

Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.

Block the use of IP-based KVM devices within the network if they are not required.

Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.