May 5, 2016 By Larry Loeb 2 min read

A security firm has found yet another way for ransomware aimed at the enterprise to propagate: remote desktop servers.

Security researchers from Fox-IT claimed remote desktop protocol (RDP) has emerged as a new point of entry into the network for malicious actors. This is a departure from its traditional use as a way for attackers to move around the network, as well as a shift from more common propagation techniques.

Exploiting Remote Desktop Servers

Just how is this accomplished? “Entries in the log files show the attackers got access to the servers by brute forcing usernames and passwords on remote desktop servers that are accessible from the Internet,” Fox-IT said. “Day in, day out, failed login attempts are recorded coming from hundreds of unique IP addresses trying hundreds of unique usernames.”

Connecting RDP services directly to the Internet is not recommended, and brute-force attacks are certainly not new. But if controls are not in place to prevent — or at least to detect and respond to — compromises, brute-force RDP attacks can still succeed.

Tracking the Mess

Once in, what do the adversaries do? Well, the RDP credentials alone might be worth money in the underground market. If the affected RDP is one piece of a bigger network, ransomware would only be viable for that segment. But if the affected RDP is on a server, then the attackers could access the entire network with their ransomware.

Working from a RDP vantage point allows the attackers time to analyze the system. They could see when backups are made, for example, so that the ransomware can strike at the most destructive time.

In one specific case, Fox-IT found that the attackers spent weeks observing the system and enterprise. When the ransomware was activated, the enterprise was in a significantly weaker position than it might have been in other circumstances.

Mitigation Methods

Mitigating the RDP risk depends on many factors. Unless it’s essential, RDP should not be facing the Internet. If remote access is needed, then user accounts with remote access should have strong passwords and preferably a multifactor authentication or second step in verification. The channel should also be encrypted to prevent eavesdropping.

Failing prevention, Fox-IT said that with “verbose logging securely stored and analyzed, accompanied by 24/7 network and endpoint monitoring, an ongoing breach or malware infection will be detected and remediated.”

This approach could help find problems associated with other breaches, as well, not just those that exploit remote desktop servers.

More from

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

How red teaming helps safeguard the infrastructure behind AI models

4 min read - Artificial intelligence (AI) is now squarely on the frontlines of information security. However, as is often the case when the pace of technological innovation is very rapid, security often ends up being a secondary consideration. This is increasingly evident from the ad-hoc nature of many implementations, where organizations lack a clear strategy for responsible AI use.Attack surfaces aren’t just expanding due to risks and vulnerabilities in AI models themselves but also in the underlying infrastructure that supports them. Many foundation…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today