RDP Abuse Present in 90% of Ransomware Breaches
Summary:
Researchers at Sophos have observed a significant rise in Remote Desktop Protocol exploitation within ransomware attacks, based on their analysis of 150 incident response cases from 2023. They found that RDP abuse featured in a staggering 90% of these cases, allowing threat actors to gain unauthorized remote access to Windows environments. This surge in RDP misuse is described by Sophos as "unprecedented" and has contributed significantly to the overall increase in ransomware attacks. Notably, external remote services, including RDP, have become the most favored initial access point for threat actors, accounting for 65% of cases in 2023. This emphasizes the critical role played by RDP vulnerabilities in facilitating these attacks.
A specific example highlighted by Sophos involved attackers successfully compromising the same victim four times within six months through exposed RDP ports. Once inside the network, the attackers engaged in lateral movement, downloaded malicious software, disabled endpoint protection measures, and established persistent remote access. This showcases the extent of damage that can result from RDP exploitation within an organization's infrastructure.
Security Officer Comments:
Sophos identifies several factors that make RDP an attractive target for ransomware actors. These include its widespread usage among network administrators, the ability to evade antivirus and endpoint detection and response systems, its intuitive graphical user interface, frequent misconfigurations that expose it to credential theft, and the use of highly privileged accounts that amplify potential damage.
Suggested Corrections:
Researchers at Sophos emphasize the importance of robust security measures and network segmentation to mitigate the risk associated with external remote services like RDP. Furthermore, exposing services without careful consideration and risk mitigation inevitably may lead to compromise, allowing attackers to easily breach RDP servers and potentially gain access to critical infrastructure such as Active Directory servers.
Link(s):
https://www.infosecurity-magazine.com/news/rdp-abuse-90-ransomware-breaches/
https://news.sophos.com/en-us/2024/04/03/active-adversary-report-1h-2024/
Researchers at Sophos have observed a significant rise in Remote Desktop Protocol exploitation within ransomware attacks, based on their analysis of 150 incident response cases from 2023. They found that RDP abuse featured in a staggering 90% of these cases, allowing threat actors to gain unauthorized remote access to Windows environments. This surge in RDP misuse is described by Sophos as "unprecedented" and has contributed significantly to the overall increase in ransomware attacks. Notably, external remote services, including RDP, have become the most favored initial access point for threat actors, accounting for 65% of cases in 2023. This emphasizes the critical role played by RDP vulnerabilities in facilitating these attacks.
A specific example highlighted by Sophos involved attackers successfully compromising the same victim four times within six months through exposed RDP ports. Once inside the network, the attackers engaged in lateral movement, downloaded malicious software, disabled endpoint protection measures, and established persistent remote access. This showcases the extent of damage that can result from RDP exploitation within an organization's infrastructure.
Security Officer Comments:
Sophos identifies several factors that make RDP an attractive target for ransomware actors. These include its widespread usage among network administrators, the ability to evade antivirus and endpoint detection and response systems, its intuitive graphical user interface, frequent misconfigurations that expose it to credential theft, and the use of highly privileged accounts that amplify potential damage.
Suggested Corrections:
Researchers at Sophos emphasize the importance of robust security measures and network segmentation to mitigate the risk associated with external remote services like RDP. Furthermore, exposing services without careful consideration and risk mitigation inevitably may lead to compromise, allowing attackers to easily breach RDP servers and potentially gain access to critical infrastructure such as Active Directory servers.
Link(s):
https://www.infosecurity-magazine.com/news/rdp-abuse-90-ransomware-breaches/
https://news.sophos.com/en-us/2024/04/03/active-adversary-report-1h-2024/