Full Report
Internet intelligence firm GreyNoise reports that it has recorded a significant spike in scanning activity consisting of nearly 1,971 IP addresses probing Microsoft Remote Desktop Web Access and RDP Web Client authentication portals in unison, suggesting a coordinated reconnaissance campaign. [...]
Analysis Summary
# Tool/Technique: Coordinated RDP/RD Web Client Scanning
## Overview
A coordinated reconnaissance campaign involving a large number of IP addresses (nearly 1,971) simultaneously probing Microsoft Remote Desktop Web Access and RDP Web Client authentication portals. The primary goal appears to be testing for timing flaws to successfully enumerate valid usernames, setting the stage for subsequent credential-based attacks like brute-forcing or password spraying.
## Technical Details
- Type: Technique (Reconnaissance, Credential Access)
- Platform: Microsoft Windows/Remote Desktop Services (RDP)
- Capabilities: User enumeration via timing analysis of login responses.
- First Seen: Significant spike reported near August 25, 2025.
## MITRE ATT&CK Mapping
- TA0043 - Credential Access
- T1110 - Brute Force
- T1110.004 - Password Guessing: Brute Force (Though this is specifically *username* enumeration to enable brute force)
- T1595 - Active Scanning
- T1595.002 - Internet Scan
## Functionality
### Core Capabilities
- Mass scanning of Microsoft RDP Web Client endpoints across numerous IP addresses.
- Testing for timing flaws: Measuring the slight differences in response time between an authentication attempt using a valid username versus an invalid username.
### Advanced Features
- High volume coordination: Nearly 2,000 unique IPs involved in the synchronized scanning effort.
- Consistent client signature: 1,851 probes shared the same client signature, suggesting the use of a unified toolset or botnet structure.
- High confidence in malice: Approximately 92% of the observed IP addresses were previously flagged as malicious by GreyNoise collectors.
## Indicators of Compromise
- File Hashes: N/A (Based on scanning activity, not malware execution)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: Scanning targeting RDP/RD Web Access authentication portals.
- Behavioral Indicators: High volume, rapid login attempts against web-based RDP interfaces exhibiting slight timing variances based on input validity.
## Associated Threat Actors
- Unspecified botnet or toolset operators. (The activity is noted as coordinated, suggesting organized malicious actors.)
## Detection Methods
- Signature-based detection: Monitoring for the specific, coordinated client signature used by the scanning entities.
- Behavioral detection: Alerting on anomalous bursts of failed login attempts or rapid-fire requests directed at RDP web endpoints originating from wide geographical areas or known malicious IPs.
- YARA rules if available: N/A
## Mitigation Strategies
- Prevention measures: Implement Multi-Factor Authentication (MFA) on all RDP portals.
- Hardening recommendations: Place RDP access or RD Web Access behind a robust VPN where possible. Harden RDP servers against brute-force attacks via network controls or account lockouts.
## Related Tools/Techniques
- Brute-force tools (e.g., Hydra) used post-enumeration.
- Automated network scanning tools utilized by botnets.
- Credential stuffing or spraying campaigns that heavily rely on knowing valid usernames.