Remote Desktop Attacks Increasing

The Remote Desktop Protocol (RDP) is being used by cyberattackers to penetrate and extract data from a network before introducing their malicious software to perform internal reconnaissance, according to a new Vectra 2019 Spotlight Report on RDP.


RDP is used by IT system administrators to centrally control their remote systems with the same functionality as if they were local, and RDP is used managed service providers in their management of hundreds of client networks and systems, notes the report. Three major attack scenarios in 2019  – an Iranian cyberespionage group; a Chinese state-sponsored actor; and a healthcare ransomware extortion scheme –  leveraged RDP as part of the broader campaign, says the report.


In September 2018, the FBI warned that the malicious use of RDP “has been on the rise since mid-late 2016," says Vectra. The FBI also reported that several high-profile ransomware attacks, such as Samsam and CrySiS, utilised RDP to laterally move inside of networks. Data from the report shows that 90 percent of the organisations exhibited some form of malicious RDP behaviors between January-June 2019.


Additional findings from the report include:


  • From January-June 2019, 26,800 suspicious RDP behaviors in more than 350 deployments were detected.
  • Manufacturing and finance organizations have the highest rate of RDP detections at 10 and eight detections per 10,000 workloads and devices, respectively.
  • The top five at-risk industries are manufacturing, finance and insurance, retail, government and healthcare. The top three industries – manufacturing, finance and insurance, and retail – together account for almost half (49.8 per cent) of all RDP detections.
  • Within the manufacturing industry, mid-sized organisations had the highest rate of RDP detections at a rate of 20 per 10,000 workloads or devices, which is 82 per cent higher than medium-sized retail and 100 percent higher than small finance and insurance organisations.



more news

Europol Releases Latest IOCTA Report


Each year, Europol’s European Cybercrime Centre (EC3) publishes the Internet Organised Crime Threat Assessment (IOCTA), its flagship strategic report on key findings and emerging threats and developments in cybercrime — threats that impact governments, businesses and citizens in the EU.

read more

European Cybersecurity Month 2019 Is launched


October marks the kick-off of the European Cybersecurity Month (ECSM), coordinated by the European Union Agency for Cybersecurity (ENISA), the European Commission and supported by the Member States. This campaign will focus on expanding awareness about cybersecurity to citizens across Europe.

read more

Remote Desktop Attacks Increasing


The Remote Desktop Protocol (RDP) is being used by cyberattackers to penetrate and extract data from a network before introducing their malicious software to perform internal reconnaissance, according to a new Vectra 2019 Spotlight Report on RDP.

read more

LexisNexis Report On Cybercrime Has Shock Figures


LexisNexis Risk Solutions has released at the Digital Identity Summit its Cybercrime Report providing a comprehensive view into the shifting global fraud landscape from January 2019 through June 2019. During this period, the LexisNexis Digital Identity Network recorded 16.4 billion transactions, of which 277 million were human-initiated attacks, a 13 per cent increase over the second half of 2018.

read more