T1663 · Remote Access Software

T1663 · Remote Access Software · Sunturai

attack-patternmobile-attackT1663

Remote Access Software

attack-pattern--0b761f2b-197a-40f2-b100-8152cb957c0c

Adversaries may use legitimate remote access software, such as `VNC`, `TeamViewer`, `AirDroid`, `AirMirror`, etc., to establish an interactive command and control channel to target mobile devices. Remote access applications may be installed and used post-compromise as an alternate communication channel for redundant access or as a way to establish an interactive remote session with the target device. They may also be used as a component of malware to establish a reverse connection to an adversary-controlled system or service. Installation of remote access tools may also include persistence.

Created: Sep 25, 2023, 7:53 PM UTC
Modified: Apr 16, 2025, 9:21 PM UTC

No published detection covers this technique

Nothing in the catalogue maps to it yet. That absence is the finding.

External references

mitre-attackT1663Open reference

Platforms

AndroidiOS

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object