Investigation of abusing RDP for ransomware deployment

You are already well aware of the fact that many threat actors involved in human-operated ransomware attacks attack public-facing Remote Desktop Protocol (RDP) servers to obtain the initial access. What's more, remote services and especially RDP is one of the most common techniques employed by ransomware affiliates for lateral movement. Unfortunately, many system and network administrators use it as well on a daily basis, so all the threat actors need is to get proper credential material.

So it shouldn't be a surprise to you that many ransomware affiliates abuse RDP to deploy ransomware as well.

In fact, in most cases, your investigation starts from the last stage of the attack life cycle – ransomware deployment. So the first thing you should do is to understand how the ransomware was deployed and what the source of infection was.

It's very common for modern ransomware to change encrypted files&apos...