Remote Services T1021
Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized…
- Tactics
- Lateral Movement
- Actors using it
- 63
- Sub-techniques
- 4
Ransomware groups reported using it
N0nthegentlemenqilinincransomakiraplayeverestOrovanightspiresarcomaclopnitrogen
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- Sandworm TeamRussia · ELECTRUM, Telebots, IRON VIKING · 64 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- Medusa Group52 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- TurlaRussia · IRON HUNTER, Group 88, Waterbug · 50 techniques
- ChimeraChina · 49 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- DragonflyRussia · TEMP.Isotope, DYMALLOY, Berserk Bear · 48 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- Threat Group-3390China · Earth Smilodon, TG-3390, Emissary Panda · 47 techniques
- NIMBUS MANTICOREUNC1549, TA455, COBALT SMOKEY · 45 techniques
- BlackByteHecamede · 44 techniques
- Salt TyphoonChina · 43 techniques
- TeamTNT43 techniques
- FIN13Elephant Beetle · 42 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- APT39Iran · ITG07, Chafer, Remix Kitten · 39 techniques
- Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586 · 39 techniques
- menuPassChina · Cicada, POTASSIUM, Stone Panda · 37 techniques
- UNC3886China · 37 techniques
- Ke3changChina · APT15, Mirage, Vixen Panda · 37 techniques
- LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium · 37 techniques
- MirrorFaceChina · Earth Kasha · 37 techniques
- PatchworkHangover Group, Dropping Elephant, Chinastrats · 34 techniques
- Storm-050134 techniques
- FIN6Magecart Group 6, ITG08, Skeleton Spider · 33 techniques
- Fox KittenIran · UNC757, Parisite, Pioneer Kitten · 31 techniques
- FIN8Syssphinx · 31 techniques
- RockeChina · 29 techniques
- HEXANELyceum, Siamesekitten, Spirlin · 29 techniques
- Indrik SpiderRussia · Evil Corp, Manatee Tempest, DEV-0243 · 27 techniques
- Cobalt GroupGOLD KINGSWOOD, Cobalt Gang, Cobalt Spider · 26 techniques
- Storm-181125 techniques
- Aquatic PandaChina · 25 techniques
- INC RansomGOLD IONIC · 25 techniques
- SilenceWhisper Spider · 25 techniques
- ToddyCat24 techniques
- APT5China · Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD · 22 techniques
- Velvet Ant22 techniques
- Play22 techniques
- APT1China · Comment Crew, Comment Group, Comment Panda · 20 techniques
- AgriusIran · Pink Sandstorm, AMERICIUM, Agonizing Serpens · 20 techniques
- Blue Mockingbird19 techniques
- AkiraGOLD SAHARA, PUNK SPIDER, Howling Scorpius · 17 techniques
- Cinnamon TempestChina · DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT · 16 techniques
- AxiomChina · Group 72 · 15 techniques
- Moses StaffIran · DEV-0500, Marigold Sandstorm · 12 techniques
- BlackTechChina · Palmerworm · 10 techniques
- Deep PandaChina · Shell Crew, WebMasters, KungFu Kittens · 10 techniques
- FIN109 techniques
- Threat Group-1314TG-1314 · 4 techniques
- Orangeworm2 techniques
- GCMAN1 techniques