T1219

Official Description

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system.

Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)

Tactics: Command And Control
Platforms: Linux, macOS, Windows
MITRE Version: 3.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Sub-techniques (3)

T1219.001 · IDE TunnelingT1219.002 · Remote Desktop SoftwareT1219.003 · Remote Access Hardware

Reported Context (254)

A call-center operator instructed the researchers to download UltraViewer, which the article says would give the attacker remote access to the victim's system. Infoblox Links Hotejka to Help TDS and Predicts Its Cloudflare Pages Domains
Scammers use the legitimate remote-access application UltraViewer to gain access to victims’ computers in tech-support scams. Investigation Links UltraViewer and UltraMailer Abuse to QuickBooks Phishing and Trojanized Installers
The actor used Zoho Assist-Unattended Support and other remote-management or tunneling mechanisms to maintain access. Kaspersky Details Storm-2603’s Fileless ToolShell Intrusion and Detection Clues
The article recommends detecting attacker abuse of remote-access tools such as AnyDesk. Healthcare Ransomware Leak-Site Listings Rose 70% to 327
The article says attackers leverage AnyDesk for hands-on-keyboard activity. ReliaQuest Reports Rising Ransomware and Vulnerability Threats to Manufacturers

CVE (121)

Malware (327)

People (144)

Threat Actors (281)

MITRE ATT&CK (279)

Vendors (181)

Products (582)

Tools (325)

Industries (147)

Countries (92)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.