Remote Access Tools
Technique · ATTACK:enterprise:T1219
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1219",
"title": "Remote Access Tools",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1219",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--4061e78c-1284-44b4-9116-73e4ac3912f7",
"external_id": "T1219",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-05-12T15:12:00.628Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "CrowdStrike 2015 Global Threat Report",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf"
},
{
"source_name": "CrySyS Blog TeamSpy",
"url": "https://blog.crysys.hu/2013/03/teamspy/"
},
{
"source_name": "Google Chrome Remote Desktop",
"url": "https://support.google.com/chrome/answer/1649523"
},
{
"source_name": "Chrome Remote Desktop",
"url": "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
},
{
"source_name": "Symantec Living off the Land",
"url": "https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf"
}
]
}Explicit source assertions (30)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03527dc8-25a6-479d-b00f-90b543944da1
Unit 42 Hildegard Malware · Cisco Talos Intelligence GroupATTACK:enterprise:T1219.003 → subtechnique-of → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0589e356-7510-4da9-bc9e-7da239dccf3f
ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11d5cf7f-7b0c-49b3-b8d0-9906f440d2d0
Dell Dridex Oct 2015ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14e8774f-a443-4065-b44d-5bb13b467c7c
ESET RTM Feb 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30854ead-6837-413b-bb8e-fcca45b95dc0
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42684416-c3f0-4668-9c86-77482740179e
Mandiant FIN7 Apr 2022ATTACK:enterprise:T1219.001 → subtechnique-of → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5325ffbb-60fb-47ab-a3ea-4fd11e941d29
ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54306888-1f93-4461-bcac-a56ae7073b31
ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58a574e4-ba44-4472-92fe-c50a9a9cbb49
Tetra Defense Sodinokibi March 2020ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78601356-fa8e-47f5-b5ad-01549bac169f
Huntress INC Ransomware May 2024 · SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fa238de-37c5-4224-b760-bf9f00001051
FireEye CARBANAK June 2017ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80a23356-20b7-49a3-a48e-e0c04e2bff86
ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88fe25f5-7274-47bf-bdbc-8e1f1d127bdc
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96934e69-6d38-4ebd-970d-3d9bf88e03e3
Securelist DarkVishnya Dec 2018ATTACK:enterprise:M1034 → mitigates → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ae55ec5-a4f8-4619-8565-fe00433c574a
ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3aa1cd-a210-4995-851f-7364bf5bb313
ElecticIQ Buyukkaya_ShinyHunters_Sept2025 · Google_SHOracle_Jun2026ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f372adb-777a-4635-9310-cbb8f432f08e
ESET Trickbot Oct 2020 · Bitdefender Trickbot March 2020ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0084acb-4ede-4dac-af86-857d5f381dac
Unit 42 Hildegard MalwareATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad949bd4-7ffd-4712-91d8-4a8523db6b50
Microsoft Prestige ransomware October 2022 · US-CERT Ukraine Feb 2016ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aeeb9a14-a1e8-4721-8e07-2f25a21f7fa6
Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af1514c0-0e58-4878-a409-9804a7ce5e0b
Group-IB AnunakATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b46ccff3-bf2a-448a-9214-7490d422ce8f
ESET MirrorFace 2025ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d39f49f7-3e63-4625-b6e9-e3fdbd0ae013
McAfee Night DragonATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5c70727-794c-4404-b30d-0d798a62ad64
ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de071e4d-eee7-4ad5-96b6-fe83bfe3e25a
Cyble Egregor Oct 2020ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e514f2a1-c3ae-403d-bbf4-8b72e29c49f1
Secureworks GOLD SAHARA · Arctic Wolf Akira 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e56fc7da-b0f8-4f18-99f4-e4b8b3258c9b
Picus BlackByte 2022 · Microsoft BlackByte 2023ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e74cdd3d-4ac7-42c5-a7ac-e2f58371fc5b
PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017ATTACK:enterprise:T1219.002 → subtechnique-of → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec52f54f-2949-446e-9a4f-18c424ee4b24
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa4c9d5a-3329-4138-b6e1-990cd7935b87