T1133: External Remote Services

Persistence Intelligence Profile

AI Answer

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows (Source: MITRE ATT&CK T1133)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1133
Name	External Remote Services
Tactic	Persistence (persistence)
Platforms	Containers, Linux, macOS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, External Remote Services (T1133) is one of the highest-connectivity ATT&CK techniques: 43 MITRE STIX relationships reference this technique; 28 threat groups observed using it; 5 software families associated; 10 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1133). Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally. Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network. Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard. Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool ShadowLink to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because ShadowLink sets up a .onion address on the compromised system. ShadowLink may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access. Adversaries may get ShadowLink to persist on a system by masquerading it as an MS Defender application.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Not available — no MITRE course-of-action was found for this technique in the ingested dataset.

Linux Rabbit
Mafalda
Hildegard
Doki
Kinsing

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

GALLIUM
Kimsuky
Volt Typhoon
APT41
Dragonfly
TeamTNT
Sandworm Team
APT18
Scattered Spider
Akira
OilRig
Sea Turtle

Group associations are from MITRE ATT&CK STIX relationships.

2015 Ukraine Electric Power Attack
C0032
SolarWinds Compromise
Operation CuckooBees
ArcaneDoor
2025 Poland Wiper Attacks
Night Dragon
Operation Wocao
C0027
CostaRicto

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1133 External Remote Services. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1133 External Remote Services?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace