Hackers Scan Over 1,000 IPs to Target Microsoft Remote Desktop Web Access

[Brownie2019]

Content source

https://gbhackers.com/hackers-scan-ips-target-microsoft-remote-desktop-web-access/

A sophisticated scanning campaign has escalated dramatically, with threat intelligence firm GreyNoise detecting over 30,000 unique IP addresses simultaneously probing Microsoft Remote Desktop Protocol (RDP) services on August 24, 2024.

This represents a significant expansion from an initial wave of nearly 2,000 IPs observed just three days earlier, marking one of the largest coordinated RDP reconnaissance operations documented this year.
The campaign first caught security researchers’ attention on August 21, when GreyNoise observed an unprecedented surge in scanning activity targeting Microsoft Remote Desktop Web Access and RDP Web Client authentication portals.
The baseline activity for these services typically involves only 3-5 IP addresses per day, making the sudden appearance of 1,971 IPs a clear anomaly representing orders of magnitude above normal levels.

Full Story:

Hackers Scan Over 1,000 IPs to Target Microsoft Remote Desktop Web Access

A campaign has escalated dramatically, 30,000 unique IP addresses simultaneously probing Microsoft Remote Desktop Protocol (RDP) services.

gbhackers.com

 

[Victor M]

" These timing attacks exploit subtle differences in server response times to determine whether submitted usernames are valid, even without providing correct passwords.


This reconnaissance technique is particularly valuable for attackers because it allows them to build comprehensive lists of valid user accounts before attempting credential-based attacks.

...

This methodical enumeration creates a foundation for subsequent credential stuffing, password spraying, or brute force attacks with significantly higher success rates. "

FROM GREYNOISE

" Recent research found spikes in attacker activity against a given technology tend to precede new vulnerabilities in that technology. In 80 percent of cases, a new vulnerability emerged within six weeks of a spike. "

 

[Zero Knowledge]

Exactly Victor there is probably new zero day vulnerability out there... Most likely anyway.