- Level of remote desktop protocol abuse unprecedented since launch of report in 2020.
- External remote services were the number-one way attackers initially breached networks.
- Remote Desktop Protocol is a Microsoft proprietary protocol that enables remote connections to other computers.
Cybercriminals have resorted to the use of remote desktop protocol in executing their attacks on systems according to new findings by Sophos. The Sophos Active Adversary Report for 2024 shows that cybercriminals heavily exploited remote desktop protocol (RDP) in 90 per cent of attacks, marking the highest incidence of RDP abuse since Sophos started these reports in 2021 covering data from 2020.
Remote Desktop Protocol (RDP) is a Microsoft proprietary protocol that enables remote connections to other computers,
The report further says that external remote services such as RDP were the most common vector by which attackers initially breached networks; they were the method of initial access in 65 percent of IR cases in 2023.
Remote Desktop Protocol a persistent threat
External remote services have consistently been the most frequent source of initial access for cybercriminals since the Active Adversary reports were launched in 2020, and defenders should consider this a clear sign to prioritize the management of these services when assessing risk to the enterprise.
Sophos field Chief Technology Officer John Shier, says that currently It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side
“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond. Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise,” said Shier.
In one Sophos X-Ops customer case, attackers successfully compromised the victim four times within six months, each time gaining initial access through the customer’s exposed RDP ports.
Once inside, the attackers continued to move laterally throughout the customer’s networks, downloading malicious binaries, disabling endpoint protection, and establishing remote access.
Compromised credentials and exploiting vulnerabilities are still the two most common root causes of attacks. However, the 2023 Active Adversary Report for Tech Leaders, released last August, found that in the first half of that year, for the first time, compromised credentials surpassed vulnerabilities as the most frequent root cause of attacks.
This trend continued through the rest of 2023, with compromised credentials representing the root cause of over 50 percent of IR cases for the entire year.
When looking at Active Adversary data cumulatively over the years from 2020 through 2023, compromised credentials were also the number one “all-time” root cause of attacks, involved in nearly a third of all IR cases.
Yet despite the historical prevalence of compromised credentials in cyberattacks, in 43% of IR cases in 2023, organizations did not have multi-factor-authentication configured.
Exploiting vulnerabilities was the second most common root cause of attacks, both in 2023 and when analyzing data cumulatively from 2020 through 2023, accounting for the root cause in 16% and 30% of IR cases, respectively.
Read also: The takedown of Chinese-backed cybercrime ring in Zambia
Threats from determined hackers
He notes that managing risk is an active process. Organizations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers.
“An important aspect of managing security risks, beyond identifying and prioritizing them, is acting on the information. Yet, for far too long, certain risks such as open RDP continue to plague organizations, to the delight of attackers who can walk right through the front door of an organization,” added Shier.
The report recommends that securing the network by reducing exposed and vulnerable services and hardening authentication will make organizations more secure overall and better able to defeat cyberattacks
Targeted organizations are located in 23 different countries, including the United States, Canada, Mexico, Colombia, the United Kingdom, Sweden, Switzerland, Spain, Germany, Poland, Italy, Austria, Belgium, the Philippines, Singapore, Malaysia, India, Australia, Kuwait, the United Arab Emirates, Saudi Arabia, South Africa, and Botswana.
Read also: Finance, government to drive $6.2Bn cyber security spending jump in 2024
