Do Son GreyNoise warns of a massive, synchronized RDP botnet using 100,000+ IPs from over 100 countries for RDP scanning and enumeration, with US infrastructure as the primary target.
RDP
A new report reveals a network of Ukrainian and offshore hosting providers are fueling large-scale brute-force and password-spraying campaigns to enable global ransomware attacks.
A new ransomware strain called Cephalus is using compromised RDP, DLL sideloading, and abused security tools to bypass defenses and intimidate victims.
GreyNoise reports a massive, coordinated scanning campaign targeting Microsoft RDP services. Attackers are probing tens of thousands of IPs to prepare for future attacks.
SafePay, a new centralized ransomware group linked to LockBit 3.0, has hit 200+ MSPs/SMBs via RDP. It bypasses Defender, encrypts files, and exfiltrates data using WinRAR and FileZilla.
A six-day RansomHub attack exploited RDP, used Atera/Splashtop RMM, Mimikatz, and Rclone to breach an enterprise, exfiltrate data, and deploy ransomware.
An unauthenticated flaw in GNOME's remote desktop (CVE-2025-5024) allows attackers to repeatedly crash Linux environments, preventing recovery even after systemd restarts.
Trend Micro reveals how Russian IP networks support North Korea’s cybercrime—from crypto theft to malware-laced fake job interviews and potential espionage.
ASEC report details Kimsuky's Larva-24005 campaign targeting South Korea and globally with RDP exploits, MySpy malware, and keyloggers.
Attackers are using "Rogue RDP" techniques, abusing RemoteApp and resource redirection to steal files and conduct espionage
Learn about CVE-2025-27095, a JumpServer vulnerability that exposes Kubernetes clusters to token leakage risks.