Procedure examples

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

Dragonfly has moved laterally via RDP.

menuPass has used RDP connections to move across the victim network.

FIN6 used RDP to move laterally in victim networks.

FIN7 has used RDP to move laterally in victim environments.

Scattered Spider has used RDP to enable lateral movement.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

Akira has used RDP for lateral movement.

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.

The APT1 group is known to have used RDP during operations.

Leviathan has targeted RDP credentials and used it to move through the victim environment.

Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.

Chimera has used RDP to access targeted systems.

MirrorFace has used RDP to exfiltrate files of interest.

Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.

Axiom has used RDP during operations.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

APT5 has moved laterally throughout victim environments using RDP.

Fox Kitten has used RDP to log in and move laterally in the target environment.

Lazarus Group malware SierraCharlie uses RDP for propagation.

INC Ransom has used RDP to move laterally.

Silence has used RDP for lateral movement.

Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

VOID MANTICORE has used RDP to move laterally within the victim environment.

HEXANE has used remote desktop sessions for lateral movement.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.

FIN10 has used RDP to move laterally to systems in the victim environment.

FIN8 has used RDP for lateral movement.

FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.

reGeorg can be used to tunnel RDP connections.

DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.

zwShell has used RDP for lateral movement.

Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.

SDBbot has the ability to use RDP to connect to victim's machines.

Pysa has laterally moved using RDP connections.

Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.

Revenge RAT has a plugin to perform RDP access.

ZxShell has remote desktop functionality.

njRAT has a module for performing remote desktop access.

jRAT can support RDP control.

WarzoneRAT has the ability to control an infected PC using RDP.

Imminent Monitor has a module for performing remote desktop access.

Koadic can enable remote desktop on the victim's machine.

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.

QuasarRAT has a module for performing remote desktop access.

During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.

During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.