T1219.002

Official Description

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)

Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

Tactics: Command And Control
Platforms: Linux, macOS, Windows
Parent Technique: T1219 · Remote Access Tools
MITRE Version: 1.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (1)

Amadey supports remote control through its VNC plugin or an RDP connection. ESET Details Its Role in Operation Endgame Disruption of Amadey and Stealc

Malware (4)

Threat Actors (2)

MITRE ATT&CK (42)

Tools (1)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.