Remote Access Tools T1219
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management…
- Tactics
- Command and Control
- Actors using it
- 25
- Sub-techniques
- 3
Ransomware groups reported using it
thegentlemenincransomakiraSilentRansomGroupplaysarcoma
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- Sandworm TeamRussia · ELECTRUM, Telebots, IRON VIKING · 64 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Medusa Group52 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- MuddyWaterIran · Earth Vetala, MERCURY, Static Kitten · 48 techniques
- BlackByteHecamede · 44 techniques
- TeamTNT43 techniques
- ShinyHuntersUNC6240, Bling Libra · 39 techniques
- Contagious InterviewDeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan · 34 techniques
- Storm-050134 techniques
- Cobalt GroupGOLD KINGSWOOD, Cobalt Gang, Cobalt Spider · 26 techniques
- Storm-181125 techniques
- INC RansomGOLD IONIC · 25 techniques
- AkiraGOLD SAHARA, PUNK SPIDER, Howling Scorpius · 17 techniques
- The GentlemenStorm-2697, GOLD SHERWOOD · 13 techniques
- Evilnum11 techniques
- DarkVishnya10 techniques
- GOLD SOUTHFIELDPinchy Spider · 9 techniques
- CarbanakAnunak · 8 techniques
- RTM7 techniques
- Thrip4 techniques