Article
GRU targeting of logistics firms: advisory AA25-141A
CISA, NSA, FBI and partners describe a GRU campaign against Western logistics and technology firms: targets, phases, CVEs and the fixes they list.
Read more
Attack technique
Remote Services
Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC.
In short
Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. Once in, the attacker can act as that user. It is a common way to move from one system to another inside a network.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Lateral Movement · Step 11 Of 15 In The Attack Chain
- MITRE IDT1021ATT&CK technique
- Detection4ways to spot itFlag logins from new places · Detection strategy MITRE lists
- Defences4ways to stop itLimit who and what can connect · Turn off what you do not need
How it works
Many tools let people connect to a machine from far away. Administrators use them every day. If an attacker gets a valid username and password, they can use the same tools to sign in and work as that user.
In a company network, one set of domain credentials often opens many servers and workstations. The same stolen login may also work on cloud services, or on management platforms for virtual machines.
Legitimate management software can be abused too. MITRE gives Apple Remote Desktop on macOS as an example, where an attacker can use it to run code remotely and move to other systems.
MITRE lists eight sub-techniques: T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1021.003 Distributed Component Object Model; T1021.004 SSH; T1021.005 VNC; T1021.006 Windows Remote Management; T1021.007 Cloud Services; T1021.008 Direct Cloud VM Connections.
A real example
Procedure examples listed by MITRE ATT&CK:
- Kivars can remotely trigger keyboard input and mouse clicks.
- MacMa can manage remote screen sessions.
- Stuxnet can spread through peer-to-peer communication and updates using RPC.
- Brute Ratel C4 can use RPC for lateral movement.
- Wizard Spider is listed by MITRE ATT&CK as having used the WebDAV protocol to run Ryuk payloads hosted on network file shares.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group Everest Everest is a financially motivated ransomware and data extortion group. Active · Since 2020 · Extortion group with ransomware and initial access broker activity
- Ransomware group Interlock Interlock is a ransomware group first observed in late September 2024. Active · Since 2024 · Not stated in the advisory (opportunistic and financially motivated, per the FBI)
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group REvil ransomware group REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Disrupted · Since 2019 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
Seen in incidents
- Incident Dutch cervical cancer screening lab breach, July 2025 In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization. July 2025 · Healthcare
- Incident Kyiv substation attack with Industroyer On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities
- Incident Poland energy sector attacks On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. December 2025 · Energy and utilities
- Incident Salt Typhoon telecom intrusions From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries. October 2024 · Telecommunications
- Incident Shamoon wiper attack on Saudi Aramco On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company. August 2012 · Energy and utilities
How to detect
-
Watch what follows a remote login
A remote login by itself is normal. Look for what comes next, such as unusual commands, file changes or new connections to other machines.
-
Flag logins from new places
An SSH session from a source address never seen before, followed by an interactive shell or a jump to higher privileges, deserves a closer look.
-
Check cloud and virtualization consoles
Watch for logins to cloud bastion hosts, VM consoles or virtualization management interfaces that are then used to open connections to other environments.
-
Detection strategy MITRE lists
DET0269, Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity.
How to defend
-
Require multi-factor authentication
Use a second factor on remote service logins where possible, so a stolen password alone is not enough.
-
Limit who and what can connect
Restrict the accounts that may use remote services and block unnecessary remote access to file shares, hypervisors and sensitive systems. Gateways can help control access.
-
Turn off what you do not need
Disable remote connection types that are not required. On ESXi servers, consider lockdown mode so hosts are managed only through vCenter.
-
Use unique, strong passwords
Do not reuse local administrator passwords across systems, and make passwords hard to guess or crack.
Questions
What is the Remote Services technique?
Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. Once in, the attacker can act as that user.
Why do attackers use remote services for lateral movement?
Administrators use remote access tools every day, so the activity can blend in. In a company network, one set of domain credentials often opens many servers and workstations, letting the attacker move from one system to another.
Which ransomware groups use Remote Services?
The page lists BianLian, Black Basta, Conti, Interlock, Medusa, Qilin, RansomHub, REvil and Rhysida as ransomware groups that use this technique, which is a common way to move from one system to another inside a network.
How do I defend against abuse of Remote Services?
Require multi-factor authentication on remote logins, restrict which accounts may use remote services, and turn off remote connection types that are not needed. Use unique, strong passwords and never reuse local administrator passwords across systems.
In our research
- GRU targeting of logistics firms: advisory AA25-141A October 2026
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- Initial access techniques: all 11 in MITRE ATT&CK October 2026
- Why Ransomware Fragmentation Makes Attribution Harder Than Ever August 2026
- RDP (Remote Desktop Protocol) Attacks Explained May 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.