# T1219.002 Remote Desktop Software

> As of 2026-10-15, T1219.002 (Remote Desktop Software) appears in 12 tracked threats, first reported 2026-07-14 and most recently 2026-10-14, with linked actors including Scattered Spider, Larva-26009, WageMole; it most often appears alongside T1036 (Masquerading).

- **Tracked threats:** 12 (8 high, 4 medium)
- **First seen:** 2026-07-14
- **Last seen:** 2026-10-14
- **Threat actors:** 3
- **Detection rules:** 43 (counts only; Blue tier and above)

## Key facts

- **ID:** T1219.002
- **Framework:** MITRE ATT&CK
- **Tactics:** Command and Control
- **Matrix:** Enterprise
- **Parent:** T1219
- **Data as of:** 2026-10-15
- **MITRE:** https://attack.mitre.org/techniques/T1219/002/

## Activity timeline

T1219.002 first appeared in tracked threats on 2026-07-14 and was most recently reported on 2026-10-14. The busiest month was 2026-10 with 8 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1219.002 Remote Desktop Software is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of [T1219 Remote Access Tools](https://intel.threadlinqs.com/technique/T1219). Threadlinqs maps 12 of 2892 tracked threats (0.4%) to it; by severity that is 8 high, 4 medium.

Threats that use T1219.002 most often also use [T1036 Masquerading](https://intel.threadlinqs.com/technique/T1036) (6 threats), [T1204.001 Malicious Link](https://intel.threadlinqs.com/technique/T1204.001) (6 threats), [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (6 threats), [T1566.002 Spearphishing Link](https://intel.threadlinqs.com/technique/T1566.002) (6 threats), [T1090 Proxy](https://intel.threadlinqs.com/technique/T1090) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

3 tracked threat actors appear in the threats that use T1219.002; the most frequent are [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) (2), [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) (1), [WageMole](https://intel.threadlinqs.com/actor/WageMole) (1).

## Threat actors using it

- [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 2
- [Larva-26009](https://intel.threadlinqs.com/actor/Larva-26009) — 1
- [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 1

## Tracked threats

12 tracked threats use T1219.002.

- [North Korean IT Worker Laptop Farms in Texas Disrupted by DOJ (Operation Lonestar Roundup) — $3M Revenue…](https://intel.threadlinqs.com/threat/TL-2026-3464) — high — 2026-10-14
- [Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell…](https://intel.threadlinqs.com/threat/TL-2026-3451) — medium — 2026-10-14
- [RSVP to Disaster: Fake Event-Invitation Phishing Delivers ConnectWise ScreenConnect as RAT](https://intel.threadlinqs.com/threat/TL-2026-3415) — high — 2026-10-13
- [Legitimate-Service Phishing (Living Off Trusted Services): ~10% of Threat Emails Abuse Trusted Platforms…](https://intel.threadlinqs.com/threat/TL-2026-3167) — high — 2026-10-09
- [Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect RMMs](https://intel.threadlinqs.com/threat/TL-2026-2998) — high — 2026-10-07
- [Phishing Campaign Abuses Legitimate ScreenConnect Client for Remote Access via Fake Payment Notification](https://intel.threadlinqs.com/threat/TL-2026-2931) — medium — 2026-10-05
- [RMM tools distributed via phishing: ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud and N-able abused…](https://intel.threadlinqs.com/threat/TL-2026-3037) — high — 2026-10-01
- [ScreenConnect Client Abused by Attackers via Mejuri-Themed Payment Receipt Phishing](https://intel.threadlinqs.com/threat/TL-2026-2826) — medium — 2026-10-01
- [Malicious ChatGPT Custom GPT "Plus 5.6" Used in ClickFix Campaign Delivering RAT via DLL Sideloading of…](https://intel.threadlinqs.com/threat/TL-2026-2766) — high — 2026-09-29
- [Abuse of AWS Systems Manager (SSM) Agent as a Remote Access Trojan](https://intel.threadlinqs.com/threat/TL-2026-1644) — medium — 2026-07-22
- [Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattack](https://intel.threadlinqs.com/threat/TL-2026-1429) — high — 2026-07-17
- [Scattered Spider (G1015): RMM-Based Persistence and Social-Engineering Intrusion Tradecraft](https://intel.threadlinqs.com/threat/TL-2026-1333) — high — 2026-07-14

## Related CVEs

CVEs referenced by the tracked threats that use T1219.002, most frequent first.

- [CVE-2021-35464](https://intel.threadlinqs.com/cve/CVE-2021-35464)

## Detection coverage

Threadlinqs maintains 43 detection rules mapped to T1219.002 (SPL 15, KQL 11, Sigma 17). Rule content is available to Blue tier accounts and above; this page shows counts only.

43 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1219 Remote Access Tools](https://intel.threadlinqs.com/technique/T1219) — 297 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1219.002
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)