Industry
Energy and utilities
Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
Read more
Attack technique
External Remote Services
External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it.
In short
External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. These services exist so staff can reach internal systems from outside. An attacker who gets valid logins can use them in the same way.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
- MITRE IDT1133ATT&CK technique
- Detection4ways to spot itOdd remote logins · Activity after the login
- Defences4ways to stop itTurn off what you do not need · Use managed access points
How it works
Many organizations let people connect to internal systems from outside through VPNs, Citrix and similar tools. A gateway checks who is connecting. Services such as Windows Remote Management and VNC can also be reachable from outside.
MITRE notes that an attacker often needs a valid account to use these services. The login details may come from credential pharming or from users after the network has been compromised.
Once in, the attacker can treat the service as a second or lasting way into the network. Some services need no login at all. In container environments, this can include an exposed Docker API, Kubernetes API server, kubelet or a web dashboard.
MITRE also describes attackers setting up a Tor hidden service on a compromised system, so that remote access reaches the network through the Tor network.
A real example
MITRE ATT&CK lists these procedure examples:
- Doki was executed through an open Docker daemon API port.
- Hildegard was executed through an unsecured kubelet that allowed anonymous access to the victim environment.
- Kinsing was executed in an Ubuntu container deployed through an open Docker daemon API.
- Linux Rabbit tries to gain access to the server over SSH.
- Mafalda can set up an SSH connection from a compromised host to a server.
Who uses it
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Everest Everest is a financially motivated ransomware and data extortion group. Active · Since 2020 · Extortion group with ransomware and initial access broker activity
- Ransomware group Hive Hive was a ransomware as a service operation active from June 2021. Disrupted · Since 2021 · Ransomware as a service
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Rhysida Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Active · Since 2023 · Ransomware as a service (profit-sharing with associates)
Seen in incidents
- Incident Lazio Region ransomware attack on the regional health system In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services. July to August 2021 · Government and public sector
- Incident Medibank ransomware and data theft, 2022 In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web. October 2022 · Financial services
- Incident Newfoundland and Labrador health system ransomware attack (2021) In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada. October to December 2021 · Healthcare
- Incident Poland energy sector attacks On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. December 2025 · Energy and utilities
- Incident SolarWinds Orion supply chain compromise The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March and June 2020. December 2020 · Technology and software supply chain
How to detect
-
Odd remote logins
Look for repeated failed logins to VPN, RDP or Citrix gateways followed by a success, especially from unusual locations or outside business hours.
-
Activity after the login
Check what happens next. Lateral movement, remote shells or unusual file transfers after an external session are a warning sign.
-
Unexpected SSH, VNC or screen sharing
Watch for inbound or outbound connections of these kinds from external sources, and for connections to container services such as the Docker or Kubernetes API from unauthorized addresses.
-
Detection strategy MITRE lists
DET0354, Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers.
How to defend
-
Turn off what you do not need
Disable or block remote services that are not required.
-
Use managed access points
Limit remote access to centrally managed concentrators such as VPNs and other managed remote access systems.
-
Require multi-factor authentication
Use strong multi-factor authentication for remote service accounts, so stolen passwords alone are not enough.
-
Segment the network
Deny direct remote access to internal systems by using proxies, gateways and firewalls. Restrict traffic to and from public Tor nodes.
Questions
What is the External Remote Services technique?
It is a technique where an attacker uses an internet-facing remote access service, such as a VPN or Citrix, to enter a network or keep access to it. MITRE ATT&CK tracks it as T1133 under Persistence and Initial Access.
How do attackers get into remote services?
MITRE notes an attacker often needs a valid account. The login details may come from credential pharming or from users after the network is compromised. Some services need no login at all, such as an exposed Docker API or Kubernetes API server.
Which services can be abused as external remote services?
VPNs and Citrix are common examples, and Windows Remote Management and VNC can also be reachable from outside. In container environments, exposed Docker or Kubernetes APIs, kubelets and web dashboards count. MITRE also describes Tor hidden services.
Which ransomware groups use External Remote Services?
The page lists BianLian, DarkSide, Hive, LockBit and Rhysida as ransomware groups that use this technique to get into networks or keep access to them.
In our research
- GRU targeting of logistics firms: advisory AA25-141A October 2026
- Akira ransomware advisory AA24-109A: stages and tools October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- ATT&CK groups by attributed origin: what is mapped October 2026
- Initial access techniques: all 11 in MITRE ATT&CK October 2026
- Leaked Credentials from Ransomware Groups: Case Insights October 2025
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.