Threat Actors Target Exposed Remote Desktop Protocol To Deploy Ransomware
Threat actors were discovered targeting open Remote Desktop Protocol (RDP) ports with variants from a range of ransomware families including Redeemer, NYX, Vohu, Amelia, BlackHunt, and MedusaLocker.
Online scanners were used to discover devices while stolen credentials or vulnerabilities were used as the initial access vector.
In some instances, adversaries were discovered exploiting the Microsoft Windows RDP BlueKeep vulnerability (CVE-2019-0708) to gain entry.
Featured Resources
View More Resources
blog
MITRE ATT&CK v19 Unpacked: What Changed and How to Operationalize
MITRE ATT&CK v19 introduces major changes that reshape how organizations understand and validate adversary behavior, including retiring the Defense Evasion tactic and introducing Stealth and Defense Impairment tactics.
Cymulate Event
CymuLab Live: A Hands-On Lab
Cymulate Event