Surge in coordinated scans targets Microsoft RDP auth servers

A recent surge in coordinated scanning activity has been detected targeting Microsoft Remote Desktop Protocol (RDP) authentication servers. This increase in scanning is believed to be a precursor to potential exploitation attempts, aiming to identify vulnerable RDP endpoints for unauthorized access. Microsoft RDP is widely used for remote management and access, making it a lucrative target for threat actors seeking to gain entry into corporate networks. The scans are characterized by their coordination, suggesting an organized effort possibly linked to known cybercriminal groups or state-sponsored actors. Security experts advise organizations to strengthen their RDP security posture by implementing multi-factor authentication, limiting RDP access via firewalls, and monitoring for unusual login attempts. Additionally, keeping systems updated with the latest patches is critical to mitigate vulnerabilities that could be exploited during these scanning campaigns. This trend highlights the ongoing risks associated with exposed RDP services and the importance of proactive defense measures to prevent breaches and ransomware attacks. Organizations should also consider using VPNs and network-level authentication to further secure remote access channels. The cybersecurity community continues to monitor these activities closely to provide timely alerts and guidance to affected entities.

This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 26 Aug 2025 06:32:13 +0000


Cyber News related to Surge in coordinated scans targets Microsoft RDP auth servers

How To Protect RDP From Ransomware Attacks - RDP is common across businesses now that roughly half of all Americans can work at least part time from home. Employees can keep their work computers in the office but use them from their home devices through RDP. How Cybercriminals Target RDP As ...
1 year ago Feeds.dzone.com
Surge in coordinated scans targets Microsoft RDP auth servers - A recent surge in coordinated scanning activity has been detected targeting Microsoft Remote Desktop Protocol (RDP) authentication servers. This increase in scanning is believed to be a precursor to potential exploitation attempts, aiming to identify ...
14 hours ago Bleepingcomputer.com
New Forensic Technique Uncovers Hidden Trails Left by Hackers Exploiting RDP - Forensic tools reconstruct attacker screen activity from thousands of 64x64 pixel bitmap fragments stored in RDP cache files, revealing viewed files and commands. Investigators identify RDP attackers through Windows Event IDs 4624/4625 and unique ...
1 month ago Cybersecuritynews.com
Microsoft Incident Response lessons on preventing cloud identity compromise - Microsoft Incident Response is often engaged in cases where organizations have lost control of their Microsoft Entra ID tenant, due to a combination of misconfiguration, administrative oversight, exclusions to security policies, or insufficient ...
1 year ago Microsoft.com
CVE-2024-56547 - In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix missed RCU barrier on deoffloading Currently, running rcutorture test with torture_type=rcu fwd_progress=8 n_barrier_cbs=8 nocbs_nthreads=8 nocbs_toggle=100 ...
7 months ago Tenable.com
Microsoft Warns of New StilachiRAT Stealing Remote Desktop Protocol Sessions Data - Microsoft has issued an urgent security advisory regarding a newly discovered malware strain called StilachiRAT, which specifically targets and exfiltrates data from Remote Desktop Protocol (RDP) sessions. Microsoft recommends organizations implement ...
5 months ago Cybersecuritynews.com
Thousands of Outdated Microsoft Exchange Servers are Susceptible to Cyber Attacks - A large number of Microsoft Exchange email servers in Europe, the United States, and Asia are currently vulnerable to remote code execution flaws due to their public internet exposure. These servers are running out-of-date software that is no longer ...
1 year ago Cysecurity.news CVE-2021-27065
Surge of swatting attacks targets corporate executives and board members - At around 8:45 pm on February 1, 2023, a caller to the Groveland, Massachusetts, 911 emergency line told dispatchers that he harmed someone in a home on Marjorie Street in the upscale small town 34 miles north of Boston. The caller also said he would ...
2 years ago Csoonline.com Cloak
How to manage a migration to Microsoft Entra ID - Microsoft Entra ID, formerly Azure Active Directory, is not a direct replacement for on-premises Active Directory due to feature gaps and alternative ways to perform similar identity and access management tasks. For some organizations, a move to ...
1 year ago Techtarget.com
Hackers Exploiting Windows .RDP Files For Rogue Remote Desktop Connections - This method, described as “Rogue RDP” by GTIG, allows attackers to access the victim’s file systems, clipboard data, and potentially even system variables, all under the guise of a legitimate application check. The deployment of ...
4 months ago Cybersecuritynews.com
New Microsoft Incident Response guides help security teams analyze suspicious activity - Today Microsoft Incident Response are proud to introduce two one-page guides to help security teams investigate suspicious activity in Microsoft 365 and Microsoft Entra. These guides contain the artifacts that Microsoft Incident Response hunts for ...
1 year ago Microsoft.com
Hackers Exploiting Domain Controller to Deploy Ransomware Using RDP - Attackers likely breached the network via a vulnerable VPN, using Mimikatz to steal credentials (caught by Microsoft Defender for Endpoint, which blocked the initial account, User 1). Microsoft has recently uncovered a sharp rise in ransomware ...
4 months ago Cybersecuritynews.com CVE-2019-0708
Microsoft: New RAT malware used for crypto theft, reconnaissance - Last but not least, Microsoft says StilachiRAT allows command execution and potential SOCKS-like proxying using commands from a command-and-control (C2) server to the infected devices, which can let the threat actors reboot the compromised system, ...
5 months ago Bleepingcomputer.com
Kimusky Hackers Exploiting RDP & MS Office Vulnerabilities in Targeted Attacks - A sophisticated Advanced Persistent Threat (APT) operation named Larva-24005, linked to the notorious Kimsuky threat group, has been discovered actively exploiting critical vulnerabilities in Remote Desktop Protocol (RDP) and Microsoft Office ...
4 months ago Cybersecuritynews.com Equation Kimsuky CVE-2019-0708
ExpressVPN bug leaked user IPs in Remote Desktop sessions - ExpressVPN has fixed a flaw in its Windows client that caused Remote Desktop Protocol (RDP) traffic to bypass the virtual private network (VPN) tunnel, exposing the users' real IP addresses. Last year, ExpressVPN faced another issue causing DNS ...
1 month ago Bleepingcomputer.com
Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation and Information Sharing - As we reflect on 2022, we've seen that malicious actors are constantly coming up with new ways to weaponize technologies at scale to cause more disruption and devastation. The dangers are showing up everywhere - and more frequently. The volume and ...
2 years ago Securityweek.com
Microsoft Fix Targets Attacks on SharePoint Zero-Day – Krebs on Security - In an advisory about the SharePoint security hole, a.k.a. CVE-2025-53770, Microsoft said it is aware of active attacks targeting on-premises SharePoint Server customers and exploiting vulnerabilities that were only partially addressed by the July 8, ...
1 month ago Krebsonsecurity.com CVE-2025-53770
Over 20,000 vulnerable Microsoft Exchange servers exposed to attacks - Tens of thousands of Microsoft Exchange email servers in Europe, the U.S., and Asia exposed on the public internet are vulnerable to remote code execution flaws. The mail systems run a software version that is currently unsupported and no longer ...
1 year ago Bleepingcomputer.com CVE-2021-26855 CVE-2021-27065
Microsoft reveals how hackers breached its Exchange Online accounts - Microsoft confirmed that the Russian Foreign Intelligence Service hacking group, which hacked into its executives' email accounts in November 2023, also breached other organizations as part of this malicious campaign. On January 12, 2024, Microsoft ...
1 year ago Bleepingcomputer.com APT29
CVE-2024-35929 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
New Remote Desktop Puzzle Let Hackers Exfiltrate Sensitive Data From Organization - “The RDP bitmap cache is a witness to remote desktop interactions, providing insights into past activities,” Pen Test Partners said to Cyber Security News. In a recent case study, Pen Test Partners investigated a data breach where an ...
3 months ago Cybersecuritynews.com
Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks - Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet, that uses both a combination of many tried-and-true techniques used by other North Korean threat actors and unique attack methodologies to target companies for ...
1 year ago Microsoft.com
400+ IPs Actively Exploiting Multiple SSRF Vulnerabilities In The Wild - Organizations should take immediate steps to ensure they are not exposed to these attacks by patching affected systems against the exploited CVEs, including CVE-2020-7796 (Zimbra Collaboration Suite), CVE-2021-22214 (GitLab CE/EE), CVE-2021-39935 ...
5 months ago Cybersecuritynews.com CVE-2020-7796
JetBrains, Rapid7 clash over vulnerability disclosure policies - A dispute between software maker JetBrains and security vendor Rapid7 has highlighted ongoing concerns with coordinated vulnerability disclosure policies and practices. On March 4, JetBrains disclosed two critical vulnerabilities tracked as ...
1 year ago Techtarget.com CVE-2024-27199 CVE-2024-27198

Cyber Trends (last 7 days)