.. /ZeroTier
Star

Access

ZeroTier is a peer-to-peer overlay network that joins hosts into a virtual L2/L3 network traversing NAT and firewalls, coordinated through ZeroTier root/controller servers (or a self-hosted controller). Threat actors deploy the ZeroTier client on compromised hosts to establish persistent, encrypted remote access into internal environments, observed with Scattered Spider/UNC3944 and the CrowdStrike telco/BPO intrusion campaign.

Paths:

Resources:

Detections:

Access

  1. Joins the host to an attacker-controlled ZeroTier network, placing it on a virtual overlay reachable by other members regardless of NAT or firewalls.

    zerotier-cli join <NETWORK_ID>
    Use case
    Establishing persistent remote access to a host behind NAT/firewall.
    Privileges required
    Administrator
    Operating systems
    Windows, Linux, MacOS

  2. Lists the ZeroTier networks the host is a member of and the assigned overlay IP addresses, confirming reachability within the mesh.

    zerotier-cli listnetworks
    Use case
    Verifying remote access into the overlay network.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Runs the ZeroTier service as a daemon so the host rejoins its networks on boot, maintaining persistent access.

    zerotier-one -d
    Use case
    Persisting overlay-network access across reboots.
    Privileges required
    Administrator
    Operating systems
    Windows, Linux, MacOS