A security firm has found yet another way for ransomware aimed at the enterprise to propagate: remote desktop servers.

Security researchers from Fox-IT claimed remote desktop protocol (RDP) has emerged as a new point of entry into the network for malicious actors. This is a departure from its traditional use as a way for attackers to move around the network, as well as a shift from more common propagation techniques.

Exploiting Remote Desktop Servers

Just how is this accomplished? “Entries in the log files show the attackers got access to the servers by brute forcing usernames and passwords on remote desktop servers that are accessible from the Internet,” Fox-IT said. “Day in, day out, failed login attempts are recorded coming from hundreds of unique IP addresses trying hundreds of unique usernames.”

Connecting RDP services directly to the Internet is not recommended, and brute-force attacks are certainly not new. But if controls are not in place to prevent — or at least to detect and respond to — compromises, brute-force RDP attacks can still succeed.

Tracking the Mess

Once in, what do the adversaries do? Well, the RDP credentials alone might be worth money in the underground market. If the affected RDP is one piece of a bigger network, ransomware would only be viable for that segment. But if the affected RDP is on a server, then the attackers could access the entire network with their ransomware.

Working from a RDP vantage point allows the attackers time to analyze the system. They could see when backups are made, for example, so that the ransomware can strike at the most destructive time.

In one specific case, Fox-IT found that the attackers spent weeks observing the system and enterprise. When the ransomware was activated, the enterprise was in a significantly weaker position than it might have been in other circumstances.

Mitigation Methods

Mitigating the RDP risk depends on many factors. Unless it’s essential, RDP should not be facing the Internet. If remote access is needed, then user accounts with remote access should have strong passwords and preferably a multifactor authentication or second step in verification. The channel should also be encrypted to prevent eavesdropping.

Failing prevention, Fox-IT said that with “verbose logging securely stored and analyzed, accompanied by 24/7 network and endpoint monitoring, an ongoing breach or malware infection will be detected and remediated.”

This approach could help find problems associated with other breaches, as well, not just those that exploit remote desktop servers.