Activity timeline
T1021.006 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 6 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1021.006 Windows Remote Management is catalogued by MITRE ATT&CK under the Lateral Movement tactic in the Enterprise matrix, as a sub-technique of T1021 Remote Services. Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 4 critical, 7 high, 1 medium.
Threats that use T1021.006 most often also use T1071.001 Web Protocols (7 threats), T1078 Valid Accounts (7 threats), T1005 Data from Local System (6 threats), T1018 Remote System Discovery (6 threats), T1490 Inhibit System Recovery (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
7 tracked threat actors appear in the threats that use T1021.006; the most frequent are Cavern Manticore (2), ALPHV (1), APT34 (1), Qilin ransomware affiliate (1), STORM-0501 (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1021.006.
Data sources
Telemetry that can reveal T1021.006, per MITRE ATT&CK.
- Command — Command Execution
- Logon Session — Logon Session Creation
- Network Traffic — Network Connection Creation, Network Traffic Flow
- Process — Process Creation
- Service — Service Metadata
Threat actors using it
Tracked threats
12 tracked threats use T1021.006.
- Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE…critical
- Impersonating IT Support: Threat Actors Turn Remote Sessions into Enterprise-Wide Access via Microsoft Teamshigh
- Aurora Ransomware Affiliate Uses Cursor AI Coding Assistant for Attack Planning, ADCS Abuse Across 20+ Victimshigh
- CVE-2026-20316: Cisco Secure Firewall Management Center Hard-coded Password Vulnerability Added to CISA KEVcritical
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar…high
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…high
- Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour…high
- July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Dayscritical
- npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain…medium
- Four Methods for Azure Blob Storage Ransomware: Client-Side Bulk Encryption, CPK, Encryption Scope, and CMK…high
- The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions…high
- Nitrogen Ransomware Coding Bug Permanently Destroys ESXi Data — Curve25519 Memory Corruption Makes…critical
Detection coverage
Threadlinqs maintains 26 detection rules mapped to T1021.006 (SPL 7, KQL 12, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1021 Remote Services — 364 tracked threats at the technique level.