Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.[1]
Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.[2] Access to remote services may be used as a redundant or persistent access mechanism during an operation.
Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.[3][4]
| ID | Name | Description |
|---|---|---|
| G0026 | APT18 |
APT18 actors leverage legitimate credentials to log into external remote services.[5] |
| G0007 | APT28 |
APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.[6] |
| G0016 | APT29 |
APT29 has used compromised identities to access VPNs and remote access tools.[7][8] |
| G0096 | APT41 |
APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.[9] |
| G0114 | Chimera |
Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.[10][11] |
| S0600 | Doki |
Doki was executed through an open Docker daemon API port.[12] |
| G0074 | Dragonfly 2.0 |
Dragonfly 2.0 used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.[13][14] |
| G0053 | FIN5 |
FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.[15][16][17] |
| G0093 | GALLIUM |
GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.[18][19] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.[20] |
| S0601 | Hildegard |
Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.[4] |
| G0004 | Ke3chang |
Ke3chang regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host.[21] |
| G0094 | Kimsuky | |
| S0599 | Kinsing |
Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.[23] |
| G0065 | Leviathan |
Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.[24] |
| S0362 | Linux Rabbit |
Linux Rabbit attempts to gain access to the server via SSH.[25] |
| G0014 | Night Dragon |
Night Dragon has used compromised VPN accounts to gain access to victim systems.[26] |
| G0049 | OilRig |
OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.[27] |
| G0116 | Operation Wocao |
Operation Wocao has used stolen credentials to connect to the victim's network via VPN.[28] |
| G0034 | Sandworm Team |
Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.[29][30][31] |
| G0139 | TeamTNT |
TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.[32] TeamTNT has also targeted exposed kubelets for Kubernetes environments.[4] |
| G0088 | TEMP.Veles |
TEMP.Veles has used a VPN to persist in the victim environment.[33] |
| G0027 | Threat Group-3390 |
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.[34] Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.[35] |
| G0102 | Wizard Spider |
Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.[36] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Disable or block remotely available services that may be unnecessary. |
| M1035 | Limit Access to Resource Over Network |
Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems. |
| M1032 | Multi-factor Authentication |
Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Two-Factor Authentication Interception techniques for some two-factor authentication implementations. |
| M1030 | Network Segmentation |
Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0015 | Application Log | Application Log Content |
| DS0028 | Logon Session | Logon Session Metadata |
| DS0029 | Network Traffic | Network Traffic Flow |
Follow best practices for detecting adversary use of Valid Accounts for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.
When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.