Technique

Remote Access Tool

Also known as: Remote Access Trojan, RAT, Remote Desktop Scam, Tech Support Remote Access, Desktop Sharing Fraud

PERSISTENCEMITRE ATT&CK: Remote Access Software technique documentation (T1219)

Installing legitimate or malicious remote access software to control victim's device.

Common attack flows

How it fits in a scam

This technique shows up duringPERSISTENCE

Before

After

Defense

How to defend against this

How to spot it

  • Unexpected remote access software installed without user initiation
  • Unknown processes running with names like AnyDesk, TeamViewer, ScreenConnect
  • Unsolicited calls or messages claiming device has technical problems
  • Requests to share 9-digit access codes or session IDs
  • Mouse cursor moving autonomously or windows opening without input
  • Unfamiliar system tray icons for remote access applications
  • Network traffic to remote access service domains
  • New persistence mechanisms like Windows Services or startup entries
  • Antivirus alerts for Rogue.TechSupportScam or RAT signatures

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Campaigns

Further reading