{"id":129772,"date":"2025-10-11T09:06:25","date_gmt":"2025-10-11T09:06:25","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=129772"},"modified":"2025-10-11T09:06:28","modified_gmt":"2025-10-11T09:06:28","slug":"hackers-attacking-rdp-services","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/","title":{"rendered":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses"},"content":{"rendered":"\n

A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.<\/p>\n\n\n\n

Security firm GreyNoise reported on October 8, 2025, that it has been tracking a significant wave of attacks originating from over 100,000 unique IP addresses spanning more than 100 countries.<\/p>\n\n\n\n

The operation appears to be centrally controlled, with the primary objective of compromising RDP infrastructure<\/a>, a critical component for remote work and administration.<\/p>\n\n\n\n

The scale and organized nature of this campaign pose a significant threat to organizations that depend on RDP for their daily operations.<\/p>\n\n\n\n

The investigation into this widespread attack began after GreyNoise analysts detected<\/a> an anomalous spike in traffic from Brazilian-geolocated IPs.<\/p>\n\n\n\n

This initial finding prompted a broader analysis, which quickly uncovered similar surges in activity from a multitude of countries, including Argentina, Iran, China, Mexico, Russia, and South Africa. Despite the diverse geographic origins, the attacks share a common target: RDP services within the United States.<\/p>\n\n\n\n

\"Botnet
Botnet Targeting RDP Infrastructure<\/figcaption><\/figure>\n\n\n\n

Analysts are highly confident that this activity is the work of a single, large-scale botnet. This conclusion is supported by the fact that nearly all participating IPs share a similar TCP fingerprint. This technical signature suggests a standard, centralized command-and-control structure orchestrating the attacks.<\/p>\n\n\n\n

The threat actors behind this campaign are employing two specific attack vectors to identify and compromise vulnerable systems.<\/p>\n\n\n\n

The first is an RD Web Access timing attack, a method where attackers measure the server’s response time to login attempts to differentiate between valid and invalid usernames anonymously.<\/p>\n\n\n\n

The second vector is an RDP web client<\/a> login enumeration, which systematically attempts to guess user credentials. These methods allow the botnet to efficiently scan for and identify exploitable RDP access points without immediately triggering standard security alerts.<\/p>\n\n\n\n

The synchronized use of these specific, non-trivial attack methods across such a vast number of nodes further points to a coordinated operation managed by a single operator or group.<\/p>\n\n\n\n

Mitigations<\/strong><\/h2>\n\n\n\n

In response to this ongoing threat, GreyNoise has released specific recommendations for network defenders. The firm advises organizations to check their security logs for any unusual RDP probing proactively or failed login attempts that match the patterns of this campaign.<\/p>\n\n\n\n

For more direct protection, GreyNoise has created a dynamic blocklist template, named \u201cmicrosoft-rdp-botnet-oct-25,\u201d available through its platform.<\/p>\n\n\n\n

This allows customers to automatically block all known IP addresses associated with this malicious botnet activity, effectively cutting off the attacks at the network perimeter.<\/p>\n\n\n\n

Organizations that use RDP for remote work should check their RDP security. They need to enforce strong password policies and use multi-factor authentication whenever possible. This will help protect against large-scale hacking attempts, such as brute-force attacks<\/a>.<\/p>\n\n\n\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States. Security firm GreyNoise reported on October 8, 2025, that it has been tracking a significant wave of attacks originating from over 100,000 unique IP addresses spanning more than 100 countries. The operation appears to be centrally controlled, with […]<\/p>\n","protected":false},"author":1,"featured_media":129774,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp","fifu_image_alt":"Hackers Attacking RDP Services","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2821,10,11],"tags":[144,149,151],"class_list":{"0":"post-129772","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-attack-news","8":"category-cyber-security","9":"category-cyber-security-news","10":"tag-cyber-attack","11":"tag-cyber-security","12":"tag-cyber-security-news"},"yoast_head":"\nHackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses<\/title>\n<meta name=\"description\" content=\"A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses\" \/>\n<meta property=\"og:description\" content=\"A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hackingtutorialsandnews\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/guruba008\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-11T09:06:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-11T09:06:28+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp\" \/><meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Guru Baran\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@guruba008\" \/>\n<meta name=\"twitter:site\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Guru Baran\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses","description":"A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/","og_locale":"en_US","og_type":"article","og_title":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses","og_description":"A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.","og_url":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/","og_site_name":"Cyber Security News","article_publisher":"https:\/\/www.facebook.com\/Hackingtutorialsandnews","article_author":"https:\/\/www.facebook.com\/guruba008","article_published_time":"2025-10-11T09:06:25+00:00","article_modified_time":"2025-10-11T09:06:28+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp","type":"","width":"","height":""},{"width":1600,"height":900,"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp","type":"image\/jpeg"}],"author":"Guru Baran","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp","twitter_creator":"@guruba008","twitter_site":"@The_Cyber_News","twitter_misc":{"Written by":"Guru Baran","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#article","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/"},"author":{"name":"Guru Baran","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/f7f138f8fd41a61bb60151da47730026"},"headline":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses","datePublished":"2025-10-11T09:06:25+00:00","dateModified":"2025-10-11T09:06:28+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/"},"wordCount":462,"publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"image":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#primaryimage"},"thumbnailUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp?w=1600&resize=1600,900&ssl=1","keywords":["cyber attack","cyber security","cyber security news"],"articleSection":["Cyber Attack News","Cyber Security","Cyber Security News"],"inLanguage":"en-US","copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cybersecuritynews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/","url":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/","name":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#primaryimage"},"image":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#primaryimage"},"thumbnailUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp?w=1600&resize=1600,900&ssl=1","datePublished":"2025-10-11T09:06:25+00:00","dateModified":"2025-10-11T09:06:28+00:00","description":"A massive, coordinated botnet campaign is actively targeting Remote Desktop Protocol (RDP) services across the United States.","breadcrumb":{"@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#primaryimage","url":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp?w=1600&resize=1600,900&ssl=1","contentUrl":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp?w=1600&resize=1600,900&ssl=1","width":"1600","height":"900","caption":"Hackers Attacking RDP Services"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecuritynews.com\/hackers-attacking-rdp-services\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecuritynews.com\/"},{"@type":"ListItem","position":2,"name":"Hackers Attacking Remote Desktop Protocol Services from 100,000+ IP Addresses"}]},{"@type":"WebSite","@id":"https:\/\/cybersecuritynews.com\/#website","url":"https:\/\/cybersecuritynews.com\/","name":"Cyber Security News","description":"World's #1 Premier Cybersecurity and Hacking News Portal","publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecuritynews.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecuritynews.com\/#organization","name":"Cyber Security News","url":"https:\/\/cybersecuritynews.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","contentUrl":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","width":200,"height":200,"caption":"Cyber Security News"},"image":{"@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hackingtutorialsandnews","https:\/\/x.com\/The_Cyber_News","https:\/\/www.linkedin.com\/company\/cybersecurity-news\/"]},{"@type":"Person","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/f7f138f8fd41a61bb60151da47730026","name":"Guru Baran","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/72f86da0bb72b6886d25f0ef0c881daba3a98356bc44f916f8d3a62c9e856579?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/72f86da0bb72b6886d25f0ef0c881daba3a98356bc44f916f8d3a62c9e856579?s=96&d=mm&r=g","caption":"Guru Baran"},"description":"Gurubaran is the Co-Founder and Editor-in-Chief of CyberSecurityNews.com, specializing in vulnerability analysis, malware research, ransomware, and computer forensics.","sameAs":["https:\/\/cybersecuritynews.com","https:\/\/www.facebook.com\/guruba008","https:\/\/www.linkedin.com\/in\/gurubaran-cyberwrites\/","https:\/\/x.com\/guruba008"],"url":"https:\/\/cybersecuritynews.com\/author\/guru\/"}]}},"jetpack_featured_media_url":"https:\/\/i1.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiNUmXNOjxiZtczszzdvAzr7ZYhz97k-xN2zjbnZabH67LmqtsBO1AJkUZ4hwucpZql7WTXmRYWVhRKSbGxAQ7vZpY8n9rZRd3JPWsffVqqF2lTQZK5SMZ8JLa1qUtFM_7fCkgxCC6A46oPc-JCYEg2ZwGwAqKHz_6N_d_8uYQ6R26CLej1__6rVQn59ig4\/s16000\/RDP%20Services%20Under%20Attack.webp?w=1600&resize=1600,900&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/129772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/comments?post=129772"}],"version-history":[{"count":1,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/129772\/revisions"}],"predecessor-version":[{"id":129773,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/129772\/revisions\/129773"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media\/129774"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media?parent=129772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/categories?post=129772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/tags?post=129772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}