A large-scale botnet is targeting Remote Desktop Protocol (RDP) services from over 100,000 IP addresses in the United States.
The campaign began on October 8 and based on the source of the IPs, researchers believe the attacks were launched by a multi-country botnet.
RDP is a network protocol that enables remote connection and control of Windows systems. It is commonly used by administrators, helpdesk staff, and remote workers.
Attackers often scan open RDP ports or attempt to force logins, exploit vulnerabilities, or conduct timing attacks.
In this case, researchers at threat monitoring platform Grenois found that the botnet relied on two types of RDP-related attacks:
- RD web access timing attack – RD probes web access endpoints and measures response-time differences during anonymous authentication flows to guess valid usernames
- RDP web client login count – Interacts with the RDP web client login flow to enumerate user accounts by observing differences in server behavior and responses
Grenois discovered the campaign after an unusual traffic increase from Brazil, which was followed by similar activity from a broader geography, including Argentina, Iran, China, Mexico, Russia, South Africa, and Ecuador.
The company says the full list of countries with compromised devices in the botnet exceeds 100.
Source: Grenoise
Almost all IP addresses share a common TCP fingerprint, and although there are variations in (maximum segment size), Researchers believe These are due to the groups creating botnets.
To protect against this activity, system administrators are advised to block IP addresses launching attacks and check logs for suspicious RDP probes.
As a general recommendation, a remote desktop connection should not be exposed to the public Internet. Adding a VPN and multi-factor authentication (MFA) adds a layer of security.
attend Breach and Attack Simulation Summit and experience future of security verificationHear from top experts and see how AI-powered BAS Changing breach and attack simulations.
Don’t miss the event that will shape the future of your security strategy
