T0886: Remote Services
Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. [1] [2] [3]
Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed [1] to multiple network segments, and can be used for Program Download or to execute attacks on control devices directly through Valid Accounts.
Specific remote services (RDP & VNC) may be a precursor to enable Graphical User Interface execution on devices such as HMIs or engineering workstation software.
Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks. [4]
Analyst context for executives and security teams
Remote Services in ICS matters because the same remote access paths that keep plants, substations, and industrial sites maintainable can also let an intruder move between business, engineering, and control-network segments. The business issue is not simply “RDP or SSH exists”; it is whether authorized remote administration, VPNs, jump hosts, data gateways, HMIs, historians, and control servers are tightly governed, logged, and segmented enough to prevent a valid connection from becoming a path to operational disruption.
Executive priority
Treat this as an operational resilience and access-governance priority. Leaders should ask which remote services are required for safe operations, who is authorized to use them, whether corporate-to-ICS paths are mediated through controlled access points, and whether evidence exists for audits and incident response. The technique is linked in ATT&CK to major ICS campaigns and to assets that often bridge operational and business needs, so budget decisions should prioritize identity controls, segmentation, remote access monitoring, and tested IR playbooks over broad, unmanaged connectivity.
Technical view
ATT&CK provides no tactic, platform, or official detection text for T0886, but the description and relationships give clear validation targets. SOC and IR teams should map remote services such as RDP, SMB, SSH, VNC, VPN access, and other remote functions across ICS network segments, especially where jump hosts, VPN servers, data gateways, HMIs, historians, control servers, application servers, switches, and DCS controllers are involved. Validate whether remote access can reach dual-homed systems or systems used for program download, valid-account access, or graphical interaction with HMI and engineering software. Use the related DET0804 detection strategy as the ATT&CK-linked detection reference, then test whether local telemetry can distinguish approved operator/admin sessions from unusual cross-segment movement.
Likely telemetry
- VPN server authentication and session records
- Jump host login, session, and command/activity logs
- RDP, VNC, SSH, SMB, and other remote service connection logs where available
- Windows/Linux authentication and account-use events on HMIs, historians, control servers, and application servers
- Network flow records showing source, destination, port, protocol, and segment traversal
Detection direction
- Start with an allowlisted baseline of expected remote service paths: approved users, source systems, destination assets, protocols, ports, time windows, and operational purpose.
- Prioritize detections for remote access crossing network segments, especially corporate-to-ICS, jump-host-to-control-network, VPN-to-ICS, and data-gateway paths.
- Correlate remote service logons with account context; Valid Accounts are explicitly referenced as a way attacks may be executed against control devices.
- Tune for ICS operational realities: vendor maintenance, operator shifts, and engineering work can look anomalous without accurate change windows and asset ownership data.
- Watch for remote GUI access to HMIs or engineering workstations because ATT&CK notes RDP and VNC may precede graphical user interface execution.
Mitigation priorities
- Define and approve required remote services for each ICS segment and disable or block unnecessary paths.
- Enforce authorization and role-based access where supported, using the ATT&CK-linked Authorization Enforcement and User Account Management mitigations as control anchors.
- Require human user authentication for remote access; use strong authentication where feasible in the ICS environment and document compensating controls where it is not.
- Use access management gateways or jump hosts to mediate access when field devices cannot enforce sufficient identity and authentication controls themselves.
- Apply network segmentation so corporate, management, and control networks cannot reach critical process control systems except through approved paths.
Analyst notes and limits
This technique is especially material in ICS because remote services are often operationally necessary. The practical defensive question is whether the organization can prove that remote access is intentional, authenticated, least-privileged, segmented, monitored, and reviewable. The supplied relationships connect T0886 to multiple ICS assets and campaigns, including Ukraine electric power attacks, Triton, Poland wiper attacks, and REvil software usage in ICS context; those relationships support prioritization but do not by themselves prove exposure or current activity in any specific environment.
The supplied ATT&CK object has no specified tactics, no platforms on the technique itself, and no official detection text. Telemetry and detection guidance therefore must be validated against local architecture, vendor constraints, asset inventory, and logging availability. This take does not claim active exploitation, customer exposure, attribution, or guaranteed detection coverage.
Remote Services
Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. [1] [2] [3]
Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed [1] to multiple network segments, and can be used for Program Download or to execute attacks on control devices directly through Valid Accounts.
Specific remote services (RDP & VNC) may be a precursor to enable Graphical User Interface execution on devices such as HMIs or engineering workstation software.
Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks. [4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
S1045: INCONTROLLER
INCONTROLLER is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. INCONTROLLER has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed INCONTROLLER was developed by CHERNOVITE.[1][2][3][4][5]
S0496: REvil
REvil is a ransomware family that has been linked to the GOLD SOUTHFIELD group and operated as ransomware-as-a-service (RaaS) since at least April 2019. REvil, which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.[1][2][3]
S0603: Stuxnet
Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]
C0028: 2015 Ukraine Electric Power Attack
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
C0025: 2016 Ukraine Electric Power Attack
2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.[1][2]
C0030: Triton Safety Instrumented System Attack
Triton Safety Instrumented System Attack was a campaign employed by TEMP.Veles which leveraged the Triton malware framework against a petrochemical organization.[1] The malware and techniques used within this campaign targeted specific Triconex Safety Controllers within the environment.[2] The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.[3]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 39f96f37549f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017
Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12
Open source URL -
[2]
Dragos December 2017
Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12
Open source URL -
[3]
Joe Slowik April 2019
Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27
Open source URL -
[4]
CISA AA21-201A Pipeline Intrusion July 2021
Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08
Open source URL -
[5]
mitre-attack T0886Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.