Procedure examples

Indrik Spider has used RDP for lateral movement.

BlackByte has used RDP to access other hosts within victim networks.

APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

Kimsuky has used RDP for direct remote point-and-click access.

Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.

Patchwork attempted to use RDP to move laterally.

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

Dragonfly has moved laterally via RDP.

menuPass has used RDP connections to move across the victim network.

FIN6 used RDP to move laterally in victim networks.

FIN7 has used RDP to move laterally in victim environments.

Scattered Spider has used RDP to enable lateral movement.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

Akira has used RDP for lateral movement.

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.

The APT1 group is known to have used RDP during operations.

Leviathan has targeted RDP credentials and used it to move through the victim environment.

Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.

Chimera has used RDP to access targeted systems.

MirrorFace has used RDP to exfiltrate files of interest.

Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.

Axiom has used RDP during operations.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

APT5 has moved laterally throughout victim environments using RDP.

Fox Kitten has used RDP to log in and move laterally in the target environment.

Lazarus Group malware SierraCharlie uses RDP for propagation.

INC Ransom has used RDP to move laterally.

Silence has used RDP for lateral movement.

Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

VOID MANTICORE has used RDP to move laterally within the victim environment.

HEXANE has used remote desktop sessions for lateral movement.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.

FIN10 has used RDP to move laterally to systems in the victim environment.

FIN8 has used RDP for lateral movement.

FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.