Remote Access Tools: Remote Desktop Software

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.^[6]

During C0018, the threat actors used AnyDesk to transfer tools between systems.^[7][8]

During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.^[9]

Contagious Interview has downloaded remote management and monitoring software such as "AnyDesk" for post compromise activities.^{[10][11][12][13][14]}

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.^[15]

Kimsuky has used a modified TeamViewer client as a command and control channel.^[16][17]

Mustang Panda has installed TeamViewer on targeted systems.^[18]

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.^[19]

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.^{[20][21][22][23][24]}

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.^[25]

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.^[26][27]

Thrip used a cloud-based remote access software called LogMeIn for their attacks.^[28]

Consider disabling unnecessary remote connection functionality, including both unapproved software installations and specific features built into supported applications.

Use application control to mitigate installation and use of unapproved software that can be used for remote access.

Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access software.