← Back to Feed
Hide Your RDP: Password Spray Leads to RansomHub Deployment
June 30, 2025 · DFIR Report · Severity: MEDIUM
Key Takeaways Case Summary This intrusion began in November 2024 with a password spray attack targeting an internet-facing RDP server. Over the course of several hours, the threat actor attempted logins against multiple accounts using known malicious IPs (based on OSINT). Several hours later they then logged in via RDP with one of the previously […] The post Hide Your RDP: Password Spray Leads to RansomHub Deployment appeared first on The DFIR Report.
Key Takeaways
- The intrusion began in November 2024 with a password spray attack targeting an internet-facing RDP server.
- The threat actor attempted logins against multiple accounts using known malicious IPs.
- The password spray attack led to RansomHub ransomware deployment.