RDP abused in over 90% of cyber attacks, Sophos finds

Threat actors are abusing the widely-used Windows remote desktop protocol (RDP) remote access feature in their attack chains at a rate unprecedented since the Covid-19 pandemic, according to new analysis released by Sophos in its latest Active Adversary Report, which explored over 150 incident response cases to which its X-Ops team responded during 2023.

It said that it saw RDP exploitation occur in 90% of cases last year, the highest rate seen since the 2021 report covering data from 2020, the pandemic’s height.

In one incident, attackers successfully compromised the victim no less than four times over a six month period, in each case gaining initial access through exposed RDP ports – which was also the most common vector via which attackers breached networks, found in 65% of the documented cases.

Once inside the victim’s network, the attackers continued to move laterally through their network, downloading malicious binaries, turning off cyber security tools that were protecting their endpoints, and establishing remote control.

“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond,” said Sophos field CTO John Shier.

“Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise. It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side.”

Shier said that an important aspect of risk management – beyond mere identification and prioritisation – was acting on available information, and yet risks such as exposed RDP ports continue to plague victims “to the delight of attackers”, suggesting too many organisations are simply not paying attention.

“Managing risk is an active process. Organisations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers…. Securing the network by reducing exposed and vulnerable services and hardening authentication will make organisations more secure overall and better able to defeat cyber attacks,” said Shier.

The latest edition of the ongoing Active Adversary series also revealed while the exploitation of vulnerabilities and the use of compromised credentials are the most common root causes of cyber attacks, the use of stolen credentials has become more widespread, and is now seen in over 50% of incident response cases – exploitation of vulnerabilities accounted for another 30%.

Shier said this was a particular concern given that in 43% of cases, organisations did not have multifactor authentication (MFA) configured properly or at all.

Other less common root causes observed by Sophos included brute force attacks (3.9% of cases), phishing (3.3%), and supply chain compromise (2.6%). In 13.6% of cases it was not possible to identify the root cause.