Follow the Access · 03 — The Exposed RDP: The Remote Desktop Left Facing the Street

Follow the Access — Case 03. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

The first two cases were about text. A default password or a guessed one opens a shell — a command line, a foothold on some Linux box that ends up mining coins or resold to a stranger. This case is about something heavier, and its disposition is the one everyone fears, because the door it opens does not lead to a shell. It leads to a desktop — the victim's own Windows desktop, mouse and Start menu and mapped drives and all — and the person who walks through it is not a script but a human being who intends to encrypt everything you own and charge you to get it back.

Remote Desktop Protocol is Microsoft's remote-control interface: it lets an administrator sit at home and see, on their own screen, the full graphical desktop of a computer at the office, as if they were physically there. It is enormously useful, and it is enormously dangerous when the office computer is left reachable from the open internet. Because then it is not only the administrator who can reach it. Anyone who finds port 3389 open and guesses the password gets exactly what the administrator gets: the whole desktop, interactive, live. And the register does not have to argue that this matters, because the highest defensive authority already has. CISA states it plainly: the two most prevalent initial-access vectors for ransomware are phishing and brute-forcing unsecured RDP. Of all the ways into a network, an exposed Remote Desktop with a weak password is one of the two front doors through which the most damaging crime on the internet actually enters.

So the disposition of this case is RANSOMED — and it is the first time in the register that the foothold is not borrowed or sold but weaponized against the victim directly. The exposed RDP endpoint is where a single guessed password becomes a hands-on-keyboard intruder, and the hands-on-keyboard intruder becomes an enterprise-wide encryption event and a seven-figure demand. This is the case about the desktop left facing the street, and the professional who walks up to it.

1. A Shell Gives You a Room; RDP Gives You the House

Begin with why RDP is categorically more dangerous than the SSH logins of the earlier cases, because the difference is not degree but kind. When an attacker guesses an SSH password, he gets a shell: a text command line on the machine. That is bad, but it is narrow — he has to know the commands, work blind through a terminal, and build his understanding of the system one typed line at a time. It is the difference between being handed a room in the dark and being handed the keys to the lit house.

RDP hands over the lit house. When the attacker logs in, his screen fills with the victim's actual Windows desktop — the same desktop the real user sees. He sees the icons, opens the Start menu, browses the file system with a mouse, reads the documents on the desktop, opens the mapped network drives to the company file server, finds the passwords saved in the browser, sees which domain the machine belongs to. He is not an exploit that a defender might catch in a log as anomalous; he is a logged-in user, doing user things, on a machine that has no reason to think the person driving the mouse is not its owner. Everything the legitimate user could do, he can do, immediately, by hand, with the full graphical environment to help him.

This is why RDP is the vector that most directly produces a human adversary inside the network. The other cases in this register mostly produce automated outcomes — a miner installed, a credential filed for sale. RDP produces a person: an intruder standing, in effect, at a desk inside the organization, free to look around and decide what to do next. And what a professional intruder decides to do, when he finds himself on a corporate Windows desktop with the whole network laid out in front of him, is rarely gentle. He is not there to borrow the CPU. He is there because behind this desktop is a business, and a business can be made to pay.

2. The Same Swarm, a Higher-Value Door

Connect this to the machinery of the earlier cases, because the way RDP is found and forced is not new — it is the brute-force swarm of Case 02, pointed at a different port. The honeypot's scanner and botnet population, the thousands of automated addresses that sweep port 22 trying weak passwords, sweep port 3389 the same way. RDP endpoints are discovered by the same internet-wide scanning, and their logins are attacked by the same credential dictionaries — administrator paired with 123456, admin with password, the short list of weak choices that some fraction of exposed machines always carry. The mechanism is identical to Case 02. What differs is the value of what lies behind the door.

Behind an SSH login on a random VPS is a Linux box worth mining. Behind an RDP login is, very often, a Windows machine belonging to a real organization — a workstation, a server, a machine joined to a corporate domain, connected to file shares and backups and other machines. The brute-force swarm does not initially know which doors lead where; it forces everything and sorts afterward. But when the sort turns up an RDP credential into a corporate environment, that credential is worth far more than a mined router, and it flows — through exactly the access-broker market of Case 02 — to the buyers who specialize in monetizing corporate access. The initial-access broker who advertises "RDP access to a US manufacturing company, domain admin, revenue \$40M" is selling precisely this: the forced or guessed RDP foothold, priced by the wealth of the business behind it.

And RDP can be taken without any guessing at all. Its exploit history includes BlueKeep — CVE-2019-0708 — a flaw in the protocol so severe that it allowed remote code execution before authentication, and so wormable that Microsoft and the NSA issued extraordinary public warnings urging the world to patch it before it could seed a self-spreading catastrophe. BlueKeep and the RDP vulnerabilities that followed meant that an exposed endpoint could be compromised with no credential, no guess, nothing but an unpatched service reachable from the internet. Whether the door is opened by a weak password or a missing patch, the lesson is the same: an RDP service facing the open internet is a high-value target under continuous attack, and its exposure is treated as a critical error precisely because of what it so reliably leads to.

3. RANSOMED — What the Professional Does Next

Now the disposition, traced step by step, because RANSOMED is not a single act but a campaign, and RDP is where that campaign begins. The attacker who lands on the corporate desktop does not immediately encrypt anything. He is a professional, and he behaves like one.

First he orients: he explores the machine, identifies the domain it belongs to, and looks for the credentials and privileges he needs. Then he escalates — using local exploits, dumped password hashes, or credentials found lying on the machine to gain administrator rights. Then he moves laterally, hopping from the first machine to others, hunting for the domain controller, the beating heart of a Windows network that, once controlled, grants authority over every machine joined to it. Along the way he does two things that turn a compromise into a catastrophe: he finds and destroys the backups, so the victim cannot simply restore, and he exfiltrates the most sensitive data he can find — financial records, personal data, intellectual property — copying it out before he does anything visible. Only then, with the backups gone, the data stolen, and control of the domain achieved, does he detonate: pushing ransomware to every machine at once, encrypting the entire estate in minutes, and leaving the ransom note.

Then comes the demand, and in the modern form it is doubled. The victim is told to pay for the decryption key — but also that if they refuse, or restore from some backup the attacker missed, the stolen data will be published or sold. This is double extortion, and it is why intact backups no longer guarantee safety: the encryption punishes you for having your data locked, and the exfiltration punishes you for getting it back. FinCEN's analysis of ransomware transactions found mean monthly volumes in the tens of millions of dollars, running through the variants of the era — Conti, REvil, DarkSide, Avaddon — each an extortion operation fed, in large part, by cheap footholds exactly like an exposed RDP. The arithmetic of the disposition is stark: a few dollars of guessing at the door, a few weeks of quiet hands-on work inside, and a demand of hundreds of thousands or millions of dollars at the end. The RDP endpoint is RANSOMED because it is the cheapest known on-ramp to the most expensive crime.

4. Why This Door Leads to Ransom and the Others Led to Mining

Pause on the divergence, because it explains something structural about the whole register. Cases 01 and 02 ended in MINED and RESOLD — the foothold borrowed for compute or sold as a commodity. This case ends in RANSOMED. The vector is not really more sophisticated; brute-forcing an RDP password is no harder than brute-forcing an SSH one. What changed the disposition is what kind of machine sits behind the door.

RDP is the Windows protocol, and Windows is the operating system of the enterprise. The Linux boxes of the earlier cases were disproportionately cheap servers, routers, and appliances — worth compute, not extortion, because no one would pay a ransom to recover a hijacked home router. But the machine that answers an RDP prompt is disproportionately a corporate asset: a domain-joined workstation or server inside a real business, connected to the systems that run that business. Such a machine is not worth mining — its value is not its CPU. It is worth ransoming, because it is a foothold into an organization that has money, that depends on its data to operate, and that can therefore be coerced into paying to get that data back. The disposition follows the victim, not the technique. Show the attacker a worthless box and he mines it; show him a door into a business and he ransoms it. RDP, more than any other vector in this register, tends to be a door into a business, which is exactly why it is the ransomware vector.

This is also why the exposed RDP endpoint is so disproportionately consequential relative to how mundane it is. The act of exposure is trivial and common — an administrator opens 3389 to the internet for convenient remote access, means to lock it down later, and never does. But that trivial act connects the ransomware economy directly to the inside of an organization, bypassing every perimeter defense, because the intruder does not break in — he logs in. The gap between how careless the exposure is and how catastrophic its consequence can be is the widest in the register so far, and it is the reason CISA's single most-repeated piece of ransomware advice is, in effect, about this one vector.

5. Taking the Desktop Off the Street

The register owes the defense, and here it is unusually clean, because unlike some vectors this one has a countermeasure that is close to absolute: do not expose RDP to the internet at all. Almost every RDP ransomware case begins with an endpoint that never needed to be internet-facing in the first place, and simply removing it from the open internet removes the vector.

The concrete steps follow from that principle. Place RDP behind a VPN or a Remote Desktop Gateway, so that reaching it at all requires first authenticating to something else — the desktop is no longer on the street, it is inside a locked building you must enter first. Require multi-factor authentication, so that a guessed or stolen password is not enough, defeating the brute-force swarm even if it finds the door. Enforce Network Level Authentication, which requires authentication before a session is established, blunting pre-auth exploits. Restrict access to known source addresses, so the endpoint is invisible to the internet-wide sweep. Use strong or randomized passwords and account lockout, so guessing does not pay. And keep the service patched, so BlueKeep-class flaws cannot take it without a credential. Each of these is standard, documented, and effective; together they take RDP off the target list entirely.

The honest note is the same one that has run through every case: the fix is known and the vector thrives anyway, because the fix is not applied. RDP remains one of the two dominant ransomware vectors not because these countermeasures fail but because, across millions of organizations, the endpoint is left facing the street — opened for convenience, forgotten, never placed behind the VPN, never given MFA. The vector's persistence is a direct measurement of a gap between knowledge and practice, and the size of that gap is written in the tens of millions of dollars of ransomware transactions that FinCEN counts every month. The desktop was left facing the street, and the street noticed.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it is fighting the last war — that RDP was the ransomware vector of 2019–2021, that the industry has since largely closed it, and that dwelling on it distracts from the vectors that matter now.

The argument runs like this. Awareness of exposed RDP is now universal; cloud platforms warn about open 3389, insurers refuse to cover it, and mature organizations have moved remote access behind VPNs and zero-trust gateways. The ransomware groups themselves, the objection continues, have largely shifted to other entry points — phishing, stolen VPN credentials, and edge-appliance exploits (the subject of later cases in this very register) — precisely because RDP got harder. So a case built on RDP and BlueKeep is describing a vector past its peak, and its central authority, the CISA finding, reflects an era that is closing. The honest read, on this view, is that exposed RDP is a solved problem for anyone competent, and the case memorializes a threat rather than warning of a live one.

The register grants the shift and rejects the dismissal. Yes, awareness has risen, mature organizations have moved RDP behind gateways, and the sophisticated groups have diversified their entry — later cases follow them to exactly the edge appliances and stolen VPN credentials the objection names. But the ransomware ecosystem is not only its most sophisticated groups, and the victim population is not only its most mature organizations. Beneath the well-defended enterprises lies a vast layer of small businesses, clinics, municipalities, schools, and managed-service customers where an RDP endpoint is still, right now, facing the internet with a weak password, because no one there has an insurer, a zero-trust architecture, or a full-time defender — and those are precisely the victims ransomware crews still hit through RDP every week. A vector being abandoned by the top tier of attackers against the top tier of targets says nothing about its continued success against everyone else, and the honeypot's data confirms the delivery mechanism — the credential swarm against exposed services — has not slowed at all. RDP earns its place in the register not as history but as the clearest illustration of the register's central law: the disposition follows the victim, and there will always be an under-defended victim with the desktop facing the street.

7. Disposition — RANSOMED

Case 03 followed the internet-facing Remote Desktop endpoint — the desktop left facing the street — from the login prompt to the foothold's fate. Unlike the text shells of the earlier cases, RDP hands the attacker the victim's own graphical Windows desktop, live and interactive, so he arrives not as an exploit but as a logged-in human adversary standing inside the network. It is found and forced by the same brute-force swarm the honeypot watches sweep port 22, redirected to port 3389, and in its exploit form taken by wormable flaws like BlueKeep with no credential at all. CISA names it one of the two dominant ransomware entry vectors, and the reason is what lies behind it: not a worthless box but a real business.

The disposition — the foothold's fate — is RANSOMED. From the interactive foothold the professional intruder escalates privilege, reaches the domain controller, destroys the backups, exfiltrates the data, and detonates ransomware across the whole estate at once, then extorts twice over — pay for the key, or the stolen data is published. A few dollars of guessing at the door becomes a demand of hundreds of thousands or millions at the end, running through the ransomware economy that FinCEN counts in tens of millions of dollars a month. The disposition diverges from the MINED and RESOLD fates of the earlier cases for one structural reason: RDP is the enterprise's protocol, so the machine that answers is worth extorting rather than merely borrowing. The disposition follows the victim.

The defense is nearly absolute and almost never fully applied: take RDP off the street — behind a VPN or gateway, with MFA, Network Level Authentication, source restriction, strong passwords, and patching — and the vector disappears. That it remains a dominant ransomware door is a measurement of how often an endpoint opened for convenience is simply left facing the internet and forgotten. The honeypot beneath these words is being swept on 3389 as it is on 22, by the same tireless swarm, looking for the one business that left its desktop showing. The vectors do not lie: the door was left facing the street, a professional found it, logged in as if he owned the place, and turned a weak password into the encryption of an entire company. We do not judge. We record. We let people judge — and then, if they are wise, take the desktop off the street.

Follow the Access continues. Case 03 disposition: RANSOMED. Confidence: HIGH — the vector's status as a primary ransomware entry point is CISA's own finding; the exploit variant (BlueKeep, CVE-2019-0708) carried Microsoft/NSA emergency advisories; the ransomware economy it feeds is quantified in FinCEN's SAR analysis and FBI IC3 reporting (Conti, REvil, DarkSide, Avaddon). The delivery mechanism — the automated credential swarm against exposed services — is corroborated by the honeypot's own scanner/credential data (Case 02). The RANSOMED-vs-MINED divergence is argued from the nature of the target (Windows enterprise vs. Linux appliance). Countermeasures follow CISA StopRansomware and Microsoft RDP-hardening guidance. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the desktop left facing the street, and the business behind it.