Blog
/
Network
/
August 3, 2022

The Risks of Remote Access Tools

Discover how remote access tools in exploitations across OT/ICS and corporate environments benefit from Darktrace's product suite.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Dylan Hinz
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
03
Aug 2022

Understanding remote access tools

In 2022, remote access tools continue to provide versatile support to organizations. By controlling devices remotely from across the globe, IT teams save on response costs, travel times, and can receive remote support from external parties like contractors [1 & 2]. This is particularly relevant in cases involving specialty machines such as OT/ICS systems where physical access is sometimes limited. These tools, however, come with their own risks. The following blog will discuss these risks and how they can be addressed (particularly in OT environments) by looking at two exploit examples from the popular sphere and within the Darktrace customer base. 

What are remote access tools?

One of the most popular remote tools is TeamViewer, a comprehensive videoconferencing and remote management tool which can be used on both desktop and handheld devices[3]. Like other sophisticated tools, when it works as intended, it can seem like magic. However, remote access tools can be exploited and may grant privileged network access to potential threat actors. Although TeamViewer needs to be installed on both perpetrator and victim devices, if an attacker has access to a misconfigured TeamViewer device, it becomes trivial to establish a foothold and deploy malware. 

How secure is remote access?

Security vulnerabilities in remote access tools

In early 2021, remote access tooling was seen on a new scale against the City of Oldsmar’s water treatment plant [4] (Figure 1). Oldsmar manages chemical concentration levels in the water for a 15,000-person city. The water treatment plant had been using TeamViewer to allow employees to share screens and work through IT issues. However, in February an employee noticed he had lost control of his mouse cursor. Initially he was unconcerned; the employee assumed that the cursor was being controlled by his boss, who regularly connected to the computer to monitor the facility’s systems. A few hours later though, the employee again saw his cursor moving out of his control and this time noticed that it was attempting to change levels of sodium hydroxide in the water supply (which is extremely dangerous for human consumption). Thankfully, the employee was able to quickly spot the changes and return them to their normal level. When looking back at the event, the key question posed by officials was where exactly the vulnerability was located in their security stack. [5]. The answer was unclear.

Photograph of compromised water plant in Florida 
Figure 1: Photograph of compromised water plant in Florida 

Tactics and strategies

When attackers get initial network access, the primary challenge for any enterprise is identifying a) that a device compromise has happened and b) how it happened. These were the same challenges seen in the Oldsmar attack. When the first physical signs of compromise occurred (cursor movement), the impacted user was still unsure whether the activity was malicious. A detailed investigation from Dragos revealed the how: evidence of a watering hole, reconnaissance activity a month prior, a targeted variant of the Tofsee botnet, and the potential presence of two separate threat actors [6 & 7]. The answer to both questions pointed to a complex attack. However, with Darktrace these questions become less important. 

How Darktrace stops compromised remote access

Darktrace does not rely on signatures but instead has AI-based models for live detection of these tools and anomalies within the wider network. Regardless of the security ‘hole’, live detection gives security teams the potential to respond in near-live time.

According to Darktrace’s Chief Product Officer, Max Heinemeyer, the Oldsmar attack was possible because it “Abused off-the-shelf tools that were already used by the client, specifically TeamViewer. This tactic, which targeted the domain controller as the initial vector, made the malware deployment easy and effective.” [8]. 

Darktrace has multiple DETECT models to provide visibility over anomalous TeamViewer or remote access tool usage:

·      Compliance / Incoming Remote Access Tool

·      Compliance / Remote Management Tool On Client

·      Compliance / Remote Management Tool On Server

·      Device / Activity Identifier / Teamviewer 

General incoming privileged connections:

·      Compliance / Incoming Remote Desktop

·      Compliance / Incoming SSH

Industrial DETECT can also highlight any new or unusual changes in ICS/OT systems:

·      ICS / Incoming ICS Command

·      ICS / Incoming RDP And ICS Commands

·      ICS / Uncommon ICS Error

Darktrace gives security teams the opportunity for a proactive response, and it is up to those teams to utilize that opportunity. In recent months our SOC Team have also seen remote access controls being abused for high-profile threats. In one example, Darktrace detected a ransomware attack supported by the installation of AnyDesk. 

Initial detection of compromise

In May a company’s mail server was detected making multiple external requests for an unusual file ‘106.exe’ using a PowerShell agent (6b79549200af33bf0322164f8a4d56a0fa08a5a62ab6a5c93a6eeef2065430ce). Although some requests were directed to sinkholes, many were otherwise successful. Subsequently a DDL file with hash f126ce9014ee87de92e734c509e1b5ab71ffb2d5a8b27171da111f96f3ba0e75 (marked by VirusTotal as malicious) was downloaded. This was followed by the installation of AnyDesk: a remote access tool likely deployed for backdoor purposes during further compromises. It is clear the threat actor then moved on to reconnaissance, with new Mimikatz use and a large volume of ICMP and SMBv.1 scanning sessions using a default credential. DCE-RPC calls were also made to the Netlogon service, suggesting a possible attempt to exploit 2020’s Zerologon vulnerability (CVE-2020-1472) [9]. When the customer then discovered a ransom note pertaining to LV (repurposed REvil), Darktrace analysts helped them to re-configure Darktrace RESPOND and turn it to active rather than human confirmation mode (Figure 2). 

Figure 2: Capture of LV ransom note provided by customer

Whilst in this instance the tool was not used for initial access, it was still an important contingency tool to ensure the threat actor’s persistency as the customer tried to respond to the ongoing breach. Yet it was the visibility provided by Darktrace model detection and changes to RESPOND configuration which ensured the customer kept up with this actor and reduced the impact of the attack. 

Looking back at Oldsmar, it is clear that being aware of remote access tools is only half the battle. More importantly, most organizations are asking if their use in attacks can be prevented in the first place. As an off-the-shelf tool, restricting TeamViewer use seems like an easy solution but such tools are often essential for maintenance and support operations. Even if limited to privileged users, these accounts are also subject to potential compromise. Instead, companies can take a large-scale view and consider the environment in which the Oldsmar attack occurred. 

How IT & OT convergence complicated this attack

In this context, the separation of OT and IT systems is a potential solution - if attackers cannot access at-risk systems, then they also cannot attack those systems. However, with recent discourse around the IT-OT convergence and increased use of IoT devices, this separation is increasingly challenging to implement [10]. Complex networking designs, stringent patching requirements and ever-changing business/operational needs are all big considerations when establishing industrial security. In fact, Tenable’s CEO Amit Yoran encouraged less separation following Oldsmar: “There’s business reasons and efficiency reasons that you might want to connect those to be able to predict when parts are going to fail or when outages are going to occur [sic].” [11]. 

When neither addressing remote access use or industrial set-up provides a quick solution, then security teams need to look to third-party support to stop similar attacks. In addition to Darktrace DETECT, our Darktrace PREVENT range with PREVENT/Attack Surface Management (ASM) can also alert security teams to internet-facing devices at risk of remote access exploitation. ASM actively queries the Shodan API for open ports on company websites and exposed servers. This highlights those assets which might be vulnerable to this type of remote access.   

Conclusion

In conclusion, TeamViewer and other remote access tools offer a lot of convenience for security teams but also for attackers. Attackers can remotely access important systems including those in the industrial network and install malware using remote access tools as leverage. Security teams need to know both their normal authorized activities and how to enforce them. With Darktrace DETECT, the tools are given transparency, with Darktrace RESPOND they can be blocked, and now Darktrace PREVENT/ASM helps to mitigate the risk of attack before it happens. As the professional world continues to embrace hybrid working, it becomes increasingly crucial to embrace these types of products and ensure protection against the dangers of unwanted remote access. 

Thanks to Connor Mooney for his contributions to this blog.

Appendices

References 

[1] https://goabacus.com/advantages-and-disadvantages-of-remote-access-service/ 

[2] https://blog.ericom.com/advantages-of-remote-access/ 

[3] https://www.teamviewer.com/en/documents/ 

[4] https://www.wired.com/story/oldsmar-florida-water-utility-hack/ 

[5 & 11] https://www.bankinfosecurity.com/ot-it-integration-raises-risk-for-water-providers-experts-say-a-18841 

[6] https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/ 

[7] https://www.dragos.com/blog/industry-news/recommendations-following-the-oldsmar-water-treatment-facility-cyber-attack/

[8] https://customerportal.darktrace.com/darktrace-blogs/get-blog/53  

[9] https://www.crowdstrike.com/blog/cve-2020-1472-zerologon-security-advisory/

[10] https://www.mckinsey.com/business-functions/operations/our-insights/converge-it-and-ot-to-turbocharge-business-operations-scaling-power

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Dylan Hinz
Cyber Analyst

More in this series

No items found.

Blog

/

/

July 23, 2025

Closing the Cloud Forensics and Incident Response Skills Gap

DFIR skills gap, man working on computer, SOC analyst, incident response, cloud incident responseDefault blog imageDefault blog image

Every alert that goes uninvestigated is a calculated risk — and teams are running out of room for error

Security operations today are stretched thin. SOCs face an overwhelming volume of alerts, and the shift to cloud has only made triage more complex.

Our research suggests that 23% of cloud alerts are never investigated, leaving risk on the table.

The rapid migration to cloud resources has security teams playing catch up. While they attempt to apply traditional on-prem tools to the cloud, it’s becoming increasingly clear that they are not fit for purpose. Especially in the context of forensics and incident response, the cloud presents unique complexities that demand cloud-specific solutions.

Organizations are increasingly adopting services from multiple cloud platforms (in fact, recent studies suggest 89% of organizations now operate multi-cloud environments), and container-based and serverless setups have become the norm. Security analysts already have enough on their plates; it’s unrealistic to expect them to be cloud experts too.

Why Digital Forensics and Incident Response (DFIR) roles are so hard to fill

Compounding these issues of alert fatigue and cloud complexity, there is a lack of DFIR talent. The cybersecurity skills gap is a well-known problem.

According to the 2024 ISC2 Cybersecurity Workforce Study, there is a global shortage of 4.8 million cybersecurity workers, up 19% from the previous year.

Why is this such an issue?

  • Highly specialized skill set: DFIR professionals need to have a deep understanding of various operating systems, network protocols, and security architectures, even more so when working in the cloud. They also need to be proficient in using a wide range of forensic tools and techniques. This level of expertise takes a lot of time and effort to develop.
  • Rapid technological changes: The cloud landscape is constantly changing and evolving with new services, monitoring tools, security mechanisms, and threats emerging regularly. Keeping up with these changes and staying current requires continuous learning and adaptation.
  • Lack of formal education and training: There are limited educational programs specifically dedicated for DFIR. Further, an industry for cloud DFIR has yet to be defined. While some universities and institutions offer courses or certifications in digital forensics, they may not cover the full spread of knowledge required in real-world incident response scenarios, especially for cloud-based environments.
  • High-stress nature of the job: DFIR professionals often work under tight deadlines in high-pressure situations, especially when handling security incidents. This can lead to burnout and high turnover rates in the profession.

Bridging the skills gap with usable cloud digital forensics and incident response tools  

To help organizations close the DFIR skills gap, it's critical that we modernize our approaches and implement a new way of doing things in DFIR that's fit for the cloud era. Modern cloud forensics and incident response platforms must prioritize usability in order to up-level security teams. A platform that is easy to use has the power to:

  • Enable more advanced analysts to be more efficient and have the ability to take on more cases
  • Uplevel more novel analysts to perform more advanced tasks than ever before
  • Eliminate cloud complexity– such as the complexities introduced by multi-cloud environments and container-based and serverless setups

What to look for in cloud forensics and incident response solutions

The following features greatly improve the impact of cloud forensics and incident response:

Data enrichment: Automated correlation of collected data with threat intelligence feeds, both external and proprietary, delivers immediate insight into suspicious or malicious activities. Data enrichment expedites investigations, enabling analysts to seamlessly pivot from key events and delve deeper into the raw data.

Single timeline view: A unified perspective across various cloud platforms and data sources is crucial. A single timeline view empowers security teams to seamlessly navigate evidence based on timestamps, events, users, and more, enhancing investigative efficiency. Pulling together a timeline has historically been a very time consuming task when using traditional approaches.

Saved search: Preserving queries during investigations allows analysts to re-execute complex searches or share them with colleagues, increasing efficiency and collaboration.

Faceted search: Facet search options provide analysts with quick insights into core data attributes, facilitating efficient dataset refinement.

Cross-cloud investigations: Analyzing evidence acquired from multiple cloud providers in a single platform is crucial for security teams. A unified view and timeline across cross cloud is critical in streamlining investigations.

How Darktrace can help

Darktrace’s cloud offerings have been bolstered with the acquisition of Cado Security Ltd., which enables security teams to gain immediate access to forensic-level data in multi-cloud, container, serverless, SaaS, and on-premises environments.

Not only does Darktrace offer centralized automation solutions for cloud forensics and investigation, but it also delivers a proactive approach Cloud Detection and Response (CDR). Darktrace / CLOUD is built with advanced AI to make cloud security accessible to all security teams and SOCs. By using multiple machine learning techniques, Darktrace brings unprecedented visibility, threat detection, investigation, and incident response to hybrid and multi-cloud environments.

[related-resource]

Continue reading
About the author

Blog

/

Email

/

July 23, 2025

Global Telecom Provider: Powering and Protecting the World's Data Giants

Default blog imageDefault blog image

This global leader plays a critical role in keeping the world connected. The company works with some of the largest and most influential public and private organizations in the world to enable ultra-fast data transmission.

Safeguarding the systems that keep the world connected

Standing at the forefront of global connectivity, this industry leader designs and manages large-scale communications systems that power the world’s most data-intensive enterprises – including social media giants, hyperscale cloud providers, and major data center operators. Given the scale, confidentiality, and sensitivity of the systems and data it helps transport, the company faces complex cybersecurity challenges.

Protecting sensitive customer data

Most of the organization’s projects are custom-designed and highly proprietary, making data privacy and Intellectual Property (IP) protection critical to maintaining trust and confidentiality with customers. In an industry where every competitor knows the landscape intimately, any loss of data could cause significant damage.

International security implications

The company faces a broad range of advanced cyber threats – from corporate espionage and supply chain risks to cyber-physical attacks on critical infrastructure. Its international footprint adds complexity, including cross-border regulatory compliance. A successful attack could disrupt business, compromise IP, or trigger wider consequences like disruptions to international data transfers and other critical services.

The global leader works closely with communities to anticipate threats that could impact the global communications network at large.

In this environment, cybersecurity is a foundation for international trust,” said the organization’s CISO.

Building a resilient cybersecurity strategy from the ground up

The CISO had the rare opportunity to build the IT and cybersecurity infrastructure from scratch. "Initially, we bought what everyone else buys,” referencing the traditional mix of firewalls, routers, and antivirus tools. “But I knew we needed to do more.”

Self-Learning AI – “the missing piece”

With solid perimeter defenses in place, the security team sought deeper protection inside the network. Darktrace’s Self-Learning AI stood out. “Unlike other solutions, Darktrace’s AI looks beyond known threat signatures, learning what’s normal for our environment and flagging what’s not. That was the missing piece – something that could help us even when everything else failed.”

A solution and partnership that delivered

The CISO said he appreciated the ability to observe Darktrace in action before full deployment, noting that the Darktrace team was there every step of the way, providing guidance and expertise to ensure he got the most out of his investment.

Partnership was especially valuable given the company’s explosive 400% growth over the last six years. As resources were stretched and priorities shifted, “Darktrace remained patient and responsive. We’re slow and methodical, but the Darktrace support team was phenomenal, never losing momentum and earning our trust.”

A unified cybersecurity ecosystem

Today, the global leader is using the Darktrace ActiveAI Security Platform™ as a core part of its layered defense strategy, including:

The CISO appreciates how, as a unified cybersecurity platform, Darktrace has an intuitive user interface, which makes it easier for his team to investigate alerts visually, even without deep technical expertise.

Advancing defenses while impacting the bottom line

A 24/7 “safety net”

The fact that this company has never been hacked is the clearest proof it made the right decision with Darktrace, said the CISO. Initially rolled out in Human Confirmation Mode, meaning it would not take autonomous action without explicit approval from the security team, Darktrace immediately uncovered threats and anomalies that other tools had missed.

Darktrace acts as a must-have safety net—ready to step in when other tools fall short,” said the CISO.

From monitoring internal behavior and identifying unusual attack patterns, to autonomously neutralizing threats after hours, the platform provides peace of mind in a high-stakes industry. “Darktrace is my dark horse – the thing I have in my back pocket if everything else fails. It’s here to save the day, save my company, and maybe even save my career.”

Autonomous capabilities free up time for skilled analysts

Darktrace’s AI-powered detection and response capabilities are deeply embedded in the team’s day-to-day operations, autonomously investigating and responding to the majority of potential threats. Cyber AI Analyst conducted a total of 2,776 total investigations within three months, averaging just 12 minutes to autonomously investigate an incident. Of those 2,776 investigations, Darktrace resolved 2,671 (96%) autonomously and escalated only 105 (4%) to analysts. Darktrace has dramatically reduced alert fatigue and freed up analysts to focus on what really matters, saving the security team 486 analyst hours on investigations within a 20-day period.

From noise to actionable insight

Darktrace delivers meaningful data and meaningful alerts. “If Darktrace escalates an incident, we drop everything and work on that. We trust in Darktrace.” When analysts do need to investigate an incident, Darktrace’s forensic logs and guided remediation suggestions have slashed the time analysts spend on investigations by four to five times.

Stronger security. Lower cost.

The CISO says, “Darktrace is a money-saver for our organization, making continued investments an easy sell to the CEO and the board.”  When he found himself down a resource after a member of the security team left the organization, the CISO turned to Darktrace Managed Threat Detection and Response services for 24/7 expert support. “It was a no brainer. We got better coverage, higher skill levels, and around-the-clock support – all for less than what we would pay to employ a single analyst.”

Scaling securely into the future

Securing networks in motion  

The organization is preparing to scale both its operations and security posture across existing distributed, mobile and deployable communications networks that historically have been disconnected. Some of these networks are in constant motion and operating in some of the world’s most volatile regions. “Darktrace will act as an autonomous defender, monitoring for anomalous behavior and intervening, when necessary, especially during those dangerous times when an asset ‘goes dark’ and becomes disconnected from the broader network,” said the CISO.

Applying AI strategically

As the organization continues to evaluate where and how to apply AI, its emphasis will be on technologies that can act independently to contain threats – especially in environments where human response may be delayed. “It’s about using the right kind of AI for the right challenge. That’s why we’re investing in Darktrace, with tools that can adapt and learn even in isolation and provide real-time protection wherever we operate.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI