Cloud Threats Memo: RDP Misconfigurations and Initial Access Brokers

A recent study by Sophos has added more fuel to the RDP fire, confirming that the exploitation of this service, when not adequately protected, remains one of the preferred techniques to compromise an organization. Not only has the exposure of RDP servers, driven by the pandemic, led to an exponential increase of brute-force attacks against this service, but it has also encouraged a flourishing market of initial access brokers. These are emerging figures in the criminal ecosystem who outsource compromised RDP and VPN credentials to criminal gangs, including ransomware operators. (By the way, did you know that even the Colonial Pipeline ransomware attack was carried out exploiting a compromised VPN access?)

The Sophos “Active Adversary Playbook 2021” confirms this scenario by providing a slightly different, but equally interesting, perspective: unsurprisingly RDP was involved in 90% of the investigated attacks, being exploited in about one out of four attacks (28% of cases) for both initial access and internal lateral movement. And again, in 41% of cases, being used exclusively for internal lateral movement.

If we consider that the same study estimated a dwell time (median time spent by the intruders in the target network before detection) of 11 days, it’s clear how protecting the initial access is vital to protecting the enterprise, limiting the exposure of the unprotected services that may be exploited by attackers.

How Netskope mitigates the risk of misconfigured RDP servers

Netskope Private Access allows you to publish resources in a simple and secure manner providing a Zero Trust alternative to legacy remote access technologies and preventing the direct exposure of services like RDP or SSH. It is possible to publish and segment virtually any application located in a local data center, as well as in a private or public cloud, without opening any inbound service that can be probed by threat actors. There is also no need for any on-prem hardware device to install, patch, and maintain, which avoids scalability issues and performance bottlenecks. Finally, a check on the security posture of the endpoint is enforced before accessing the target application. A smarter and more secure way to provide remote connectivity in the “new normal.”

Stay safe!