Procedure examples

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.

DarkVishnya used DameWare Mini Remote Control for lateral movement.

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.

INC Ransom has used AnyDesk and PuTTY on compromised systems.

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.

TrickBot uses vncDll module to remote control the victim machine.

InvisibleFerret has utilized remote access software including AnyDesk client through the “adc” module. InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for `C:/Program Files(x86)/AnyDesk/AnyDesk.exe`.

Hildegard has established tmate sessions for C2 communications.

Carbanak has a plugin for VNC and Ammyy Admin Tool.

RTM has the capability to download a VNC module from command and control (C2).

Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.

Dridex contains a module for VNC.

ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.

During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.

During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.

Mustang Panda has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the `code.exe tunnel` command.

During C0018, the threat actors used AnyDesk to transfer tools between systems.

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.

During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.

Kimsuky has used a modified TeamViewer client as a command and control channel.

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Mustang Panda has installed TeamViewer on targeted systems.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.

Thrip used a cloud-based remote access software called LogMeIn for their attacks.

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.

Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.

During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.

Higaisa used an XSL file to run VBScript code.

Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.

Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.

During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.

During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.

Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.

DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.

Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.

MirrorFace has used remote template injection to retrieve malicious payloads from the C2.

APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.

Inception has used decoy documents to load malicious remote payloads via HTTP.

Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.

WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.

Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.