


RDP is typically used in a business environment to allow end users to remotely access files and applications stored on the organization’s local network.

RDP transmits the display of the remote server to the client and the input of peripherals (such as keyboard and mouse) from the client to the remote server, effectively allowing users to control a remote computer as though they were operating it in person. Available for most Windows operating systems, it provides a graphical interface that enables users to connect remotely to a server or another computer. RDP is a network communications protocol developed by Microsoft. In this blog post, we will discuss why threat actors use RDP to deploy malware, how our solutions protect users against RDP brute-force attacks and best practices for mitigating RDP-based threats. The number of Internet-exposed RDP ports grew from approximately 3 million in January 2020 to more than 4.5 million in March, according to a McAfee report. Threat actors predicted that many organizations would not have the time or resources to securely implement RDP during the mass transition to working from home and, as a result, may be vulnerable to compromise. However, the rapid shift to remote working has also provided a unique opportunity for ransomware groups. In recent months, organizations across every sector have come to rely heavily on Remote Desktop Protocol (RDP) to maintain business continuity while respecting social distancing.
