Skip to content

External Remote Services

Technique · ATTACK:enterprise:T1133

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1133",
  "title": "External Remote Services",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1133",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--10d51417-ee35-4589-b1ff-b6df1c334e8d",
  "external_id": "T1133",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:44.421Z",
  "modified": "2026-05-12T15:12:00.621Z",
  "version": "2.5",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "Volexity Virtual Private Keylogging",
      "url": "https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/"
    },
    {
      "source_name": "MacOS VNC software for Remote Desktop",
      "url": "https://support.apple.com/guide/remote-desktop/set-up-a-computer-running-vnc-software-apdbed09830/mac"
    },
    {
      "source_name": "Unit 42 Hildegard Malware",
      "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
    },
    {
      "source_name": "Russian threat actors dig in, prepare to seize on war fatigue",
      "url": "https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/russian-threat-actors-dig-in-prepare-to-seize-on-war-fatigue"
    },
    {
      "source_name": "The BadPilot campaign",
      "url": "https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/?ref=thestack.technology"
    },
    {
      "source_name": "Trend Micro Exposed Docker Server",
      "url": "https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html"
    }
  ]
}

Explicit source assertions (48)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01bebfd2-6c8c-4671-8754-34ca03c44299

Unit 42 Hildegard Malware · Cisco Talos Intelligence Group · Intezer TeamTNT September 2020

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c4c857-59e6-4168-b2af-96b6609bdc76

Mandiant FIN13 Aug 2022

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b85db78-5473-4cfb-8908-13b108289df2

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0362 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f8572d0-007f-4efd-8caa-58ea88849cd1

Anomali Linux Rabbit 2018

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21fdb8cc-baed-4b9a-871e-f74dc0f0f2d9

McAfee Night Dragon

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b7c7d72-1858-4e36-a96b-6377272daf70

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ac252c3-1505-4bbe-9093-de7f9ef3f7b5

CISA GRU29155 2024

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b521f87-a77d-4c8d-8ab8-ffc6dbc3d62e

RSA2017 Detect and Respond Adair

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d450e48-e73f-417f-941d-85c8658f5d1f

ANSSI Sandworm January 2021 · ESET BlackEnergy Jan 2016 · ESET Telebots June 2017 · mandiant_apt44_unearthing_sandworm

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--419745f1-4065-4aad-bf90-ffe198562bd8

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48611952-483d-4469-a3f1-745b40207055

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c595f86-f839-44a3-81c8-8a1cab9f4293

Unit 42 Hildegard Malware

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f7a6812-5026-47ce-9424-e6658cec5e54

CrowdStrike Scattered Spider BYOVD January 2023

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--556f8dd8-50e0-4115-9815-c20bfc2b915a

FireEye APT41 Aug 2019

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55af723a-6ca6-449d-be8e-d61a067fbefd

NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55e34506-746d-4895-928b-72c2e358161d

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57b4f42b-02e2-4cee-98f0-d6935c1e2c7b

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60069193-4573-420f-9b2e-e9a42b95af12

NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62ed20e9-07e5-4e22-a8dd-b93ab89706e3

Booz Allen Hamilton

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7302a389-7e1e-43b6-8b04-88ab89f17470

Defending Against Malicious Cyber Activity Originating from Tor

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79b0a6bc-4061-468c-ac1b-eef3dc3fb419

FireEye KEGTAP SINGLEMALT October 2020

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bc0dbc4-f84b-448a-95f9-f6b0ae56f256

Mandiant APT29 Microsoft 365 2022 · NCSC APT29 July 2020

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8df2f4b5-3f60-4b8f-b4aa-dd76eb347ab0

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f354951-cd88-4193-b3d5-b95038938c7f

BlackBerry CostaRicto November 2020

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9655304e-7bdb-4375-8789-2bfecc5b0a64

CISA AA20-301A Kimsuky

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98a10168-649c-4153-b321-e12a7df9010c

CERT Polska · Dragos ELECTRUM JAN 2026

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9aaf5e70-4080-4f73-8d6d-3b19f754e9b9

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9abd0448-a3b7-4262-8753-fe81dc91c434

Mandiant FIN5 GrrCON Oct 2016 · DarkReading FireEye FIN5 Oct 2015 · FireEye Respond Webinar July 2017

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9eaaffb7-4dc4-4aac-a1d5-675b71e587df

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0c23dc4-d3ad-4312-a10c-001e7040a32b

CrowdStrike StellarParticle January 2022 · MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab6a19e4-ce00-46cd-ae83-0798471e4a4a

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad5cf8f1-5915-41e2-87d5-a06ac1e6b3b6

Hunt Sea Turtle 2024

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0c5bff6-44da-421f-adf4-d9b3c8746693

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4728dde-0d7b-4650-910d-4778a07cbfa0

Aqua Kinsing April 2020

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbb92214-8772-4e46-916b-2d9c0cdec83e

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc7f00a2-ba1c-428a-ba8f-174703389c73

Secureworks REvil September 2019

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd590dd0-7fec-4526-96f1-96a91ca15954

Recorded Future TAG-144 AUG 2025

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd8a36f5-1da5-49de-b292-ac0e4a58340c

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5a19163-a5b3-4b14-bf9d-d23d95d218d4

FireEye TRITON 2019

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc6b3d5d-f77d-4c83-b484-1f2516133950

US-CERT TA18-074A · CISA AA20-296A Berserk Bear December 2020

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2825a04-d5c4-4598-aa3d-cb72cfe74ac4

Secureworks GOLD SAHARA

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d811c17d-5ed4-4218-b1c9-280e332e30e2

Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d92510c1-43d7-4b4c-b3a1-cf7ae0387737

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e132dd40-7779-44dc-9e4a-74514381407c

FoxIT Wocao December 2019

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e23d57b4-5bc4-4d06-9084-9c99464c4af8

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eebb6a7d-0be4-430c-a9a2-aeb786521e0d

CCCS ArcaneDoor 2024

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eef34338-cf9a-4ba9-986d-f4d49a9d110a

Intezer Doki July 20

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa6bb182-28e8-4293-90ba-ee9a5c23d45b

CISA AA21-200A APT40 July 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.