Use application control to mitigate installation and use of unapproved software that can be used for remote access. TrickBot uses vncDll module to remote control the victim machine. Thrip used a cloud-based remote access software called LogMeIn for their attacks. TeamTNT has established tmate sessions for C2 communications. Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers. RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
#Teamviewer unattended access download#
RTM has the capability to download a VNC module from command and control (C2). Night Dragon has used several remote administration tools as persistent infiltration channels. Mustang Panda has installed TeamViewer on targeted systems. MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally. Kimsuky has used a modified TeamViewer client as a command and control channel.
Hildegard has established tmate sessions for C2 communications. GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
ĮVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines. Įgregor has checked for the LogMein event log in an attempt to encrypt files in remote machines. ĭarkVishnya used DameWare Mini Remote Control for lateral movement. Ĭobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost. Ĭarbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems. Ĭarbanak has a plugin for VNC and Ammyy Admin Tool. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.Īdmin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns. Remote access tools may be established and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
0 kommentar(er)
