Procedure examples

Kimsuky has used a modified TeamViewer client as a command and control channel.

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Mustang Panda has installed TeamViewer on targeted systems.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.

Thrip used a cloud-based remote access software called LogMeIn for their attacks.

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.