{"id":34714,"date":"2020-04-30T14:45:35","date_gmt":"2020-04-30T14:45:35","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31164\/Brute-Forcing-RDP-Credentials-On-The-Rise.html"},"modified":"2020-04-30T14:45:35","modified_gmt":"2020-04-30T14:45:35","slug":"brute-forcing-rdp-credentials-on-the-rise","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/brute-forcing-rdp-credentials-on-the-rise\/","title":{"rendered":"Brute Forcing RDP Credentials On The Rise"},"content":{"rendered":"
<\/div>\n
\n

A huge uptick in brute force attacks designed to crack the login credentials of those using remote access tools has been detected by Kaspersky.<\/p>\n

This is particularly taking place against firms using Microsoft\u2019s proprietary Remote Desktop Protocol (RDP). Staring in March the average daily number of attacks against RDP accounts skyrocketed in almost every country that has been heavily impacted by COVID-19 and thus has a new WFH population.<\/p>\n

\u201cAttacks of this type are attempts to brute-force a username and password for RDP by systematically trying all possible options until the correct one is found. The search can be based on combinations of random characters or a dictionary of popular or compromised passwords,\u201d Kaspersky said.<\/p>\n

In the United States attacks had averaged about 200,000 per day for March, but on March 10 spiked to 800,000 and eventually topping out at 1.4 million attempts on April 7. Spain, France, Italy, Germany, Russia also similar patterns emerge. Kaspersky is not sure why the jump took place on March 10.<\/p>\n

\u201cIt\u2019s hard to say why March 10 was the day when it all started, but possibly it doesn\u2019t have any logical explanation. As for the technical means used by the attacker, it\u2019s likely that some bot-net is involved, since malicious hosts are scattered worldwide. We are still investigating this question,\u201d Dmitry Galov, Kaspersky security researcher.told SC Media.<\/p>\n

Despite being at the epicenter of the virus, China has not experienced a similar increase in attacks. This is due to the fact its population did not begin working from home in large numbers.<\/p>\n

Kaspersky recommended some steps that can help protect against these attacks:<\/p>\n