Remote Desktop Software
Subtechnique · ATTACK:enterprise:T1219.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1219.002",
"title": "Remote Desktop Software",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1219/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d4287702-e2f7-4946-bdfa-2c7f5aaa5032",
"external_id": "T1219.002",
"domain": "enterprise",
"created": "2025-03-24T22:24:47.684Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "CrowdStrike 2015 Global Threat Report",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf"
},
{
"source_name": "CrySyS Blog TeamSpy",
"url": "https://blog.crysys.hu/2013/03/teamspy/"
},
{
"source_name": "Google Chrome Remote Desktop",
"url": "https://support.google.com/chrome/answer/1649523"
},
{
"source_name": "Chrome Remote Desktop",
"url": "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
},
{
"source_name": "Symantec Living off the Land",
"url": "https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ea2fee2-66aa-4c6a-9617-94cbdbdf4d4b
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--147c6a91-6bf4-458f-94ba-bdb950ecd3bb
Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a5341b9-e987-4687-b8f2-6c798f1ac0ae
ESET EvilNum July 2020ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3396c5b4-3f52-498d-9dfd-812fb0acd543
Microsoft Storm-1811 2024 · rapid7-email-bombingATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d32be2c-02cd-4210-879a-429ca9d21f99
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e341596-3bc3-4d9e-a9a3-2aceccfebe35
Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fc9c0a5-952f-4726-8c53-39fbf40a67e3
Crowdstrike GTR2020 Mar 2020 · Securelist Kimsuky Sept 2013ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52f31493-1654-4516-960d-c79018f1efd8
Symantec Thrip June 2018ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--685a8409-db59-4ef3-b4de-786b87be8839
Group IB RTM August 2019ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--856e9f30-99b4-4167-bcb5-f41fc9559d74
Check Point VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87e0b924-d2a6-4e65-95ed-9500670bbe5c
CrowdStrike Scattered Spider JUL 2025 · Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · Trellix Scattered Spider MO August 2023ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90c4707e-201f-4204-9e99-2e043c451055
TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--920bf6ed-ca97-4d30-8520-1af593872770
ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98fb9ba2-df83-48d5-a962-7de7070d567f
ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa308c15-3c8d-4df7-a6b2-0a4f61ef8d03
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d35f97c3-2776-4f7a-9dfa-be39009ea5c0
DFIR Conti Bazar Nov 2021ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d567348d-6d6d-463b-acc3-f9d2640171ac
FalconFeeds_Iran_Mar2026 · FalconFeeds_MuddyWaterPSRust_Mar2026 · Anomali Static Kitten February 2021 · Proofpoint TA450 Phishing March 2024 · NaumaanProofpoint_GlobalClickFix_April2025 · Trend Micro Muddy Water March 2021 · group-ib_muddywater_infraATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea813141-a2a2-4e27-b30e-6e7c9f2980f2
ATTACK:enterprise:T1219.002 → subtechnique-of → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec52f54f-2949-446e-9a4f-18c424ee4b24
ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff972951-9c3f-43f3-aa44-857f2b4452e9
Trend Micro Agenda Ransomware OCT 2025