Activity timeline
T1219.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 8 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1219.002 Remote Desktop Software is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of T1219 Remote Access Tools. Threadlinqs maps 12 of 2892 tracked threats (0.4%) to it; by severity that is 8 high, 4 medium.
Threats that use T1219.002 most often also use T1036 Masquerading (6 threats), T1204.001 Malicious Link (6 threats), T1204.002 Malicious File (6 threats), T1566.002 Spearphishing Link (6 threats), T1090 Proxy (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
3 tracked threat actors appear in the threats that use T1219.002; the most frequent are Scattered Spider (2), Larva-26009 (1), WageMole (1).
Threat actors using it
Tracked threats
12 tracked threats use T1219.002.
- North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue…high
- Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…medium
- RSVP to Disaster: Fake Event-Invitation Phishing Delivers ConnectWise ScreenConnect as RAThigh
- Legitimate-Service Phishing (Living Off Trusted Services): ~10% of Threat Emails Abuse Trusted Platforms…high
- Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect RMMshigh
- Phishing Campaign Abuses Legitimate ScreenConnect Client for Remote Access via Fake Payment Notificationmedium
- RMM tools distributed via phishing: ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud and N-able abused…high
- ScreenConnect Client Abused by Attackers via Mejuri-Themed Payment Receipt Phishingmedium
- Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…high
- Abuse of AWS Systems Manager (SSM) Agent as a Remote Access Trojanmedium
- Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattackhigh
- Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion Tradecrafthigh
Detection coverage
Threadlinqs maintains 43 detection rules mapped to T1219.002 (SPL 15, KQL 11, Sigma 17). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1219 Remote Access Tools — 297 tracked threats at the technique level.