+- Sinisterly (https://sinister.li)
+-- Forum: General (https://sinister.li/Forum-General)
+--- Forum: World News (https://sinister.li/Forum-World-News)
+--- Thread: New Brute-Force Botnet Targeting Over 1.5 Million RDP Servers Worldwide (/Thread-New-Brute-Force-Botnet-Targeting-Over-1-5-Million-RDP-Servers-Worldwide)
New Brute-Force Botnet Targeting Over 1.5 Million RDP Servers Worldwide - Tracefl0w - 07-03-2019
New Brute-Force Botnet Targeting Over 1.5 Million RDP Servers Worldwide
Security researchers have discovered an ongoing sophisticated botnet campaign that is currently brute-forcing more than 1.5 million publicly accessible Windows RDP servers on the Internet.
Dubbed GoldBrute, the botnet scheme has been designed in a way to escalate gradually by adding every new cracked system to its network, forcing them to further find new available RDP servers and then brute force them.
To fly under the radar of security tools and malware analysts, attackers behind this campaign command each infected machine to target millions of servers with a unique set of username and password combination so that a targeted server receives brute force attempts from different IP addresses.
![[Image: bkwxsZs.png]](https://i.imgur.com/bkwxsZs.png)
Certainly a very interesting article that I came across. It raises all kind of questions, currently there's an unpacthed vulnerability within Windows that allows client-side attackers to bypass the lock screen on remote desktop (RD) sessions.
This could potentially cause havoc around the world, which could be much worse than the WannaCry and NotPetya wormable attacks were in 2017.
Source: https://thehackernews.com/2019/06/windows-rdp-brute-force.html
RE: New Brute-Force Botnet Targeting Over 1.5 Million RDP Servers Worldwide - Mahal - 07-04-2019
Well this is nothing new so
RE: New Brute-Force Botnet Targeting Over 1.5 Million RDP Servers Worldwide - Drako - 07-04-2019
Wow, that's a pretty damn ingenious idea. But it's inevitable when you have a group of bored criminals.