An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software tools, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.123 Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.45
- Symantec Living off the Land
- CrowdStrike 2015 Global Threat Report
- CrySyS Blog TeamSpy
- Google Chrome Remote Desktop
- Chrome Remote Desktop
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0076 | Thrip | — |
| grp_g0048 | RTM | — |
| grp_g0120 | Evilnum | — |
| grp_g0129 | Mustang Panda | China |
| grp_g1015 | Scattered Spider | — |
| grp_g1053 | Storm-0501 | — |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g1055 | VOID MANTICORE | — |
| grp_g1058 | The Gentlemen | — |
| grp_g1046 | Storm-1811 | — |
| grp_g0094 | Kimsuky | DPRK |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.