Hackers Target RDP Services from Over 100,000 IP Addresses

A massive, coordinated botnet campaign has emerged, targeting Remote Desktop Protocol (RDP) services across the United States.

Since October 8, 2025, cybersecurity firm GreyNoise has tracked over 100,000 unique IP addresses participating in the attacks.

The unprecedented scale of this operation spans more than 100 countries, demonstrating a sophisticated and well-orchestrated threat against American RDP infrastructure.

Coordinated Global Attack Campaign Targets US Infrastructure

The botnet employs two primary attack vectors against RDP services: Microsoft RD Web Access Anonymous Authentication Timing Attacks, and Microsoft RDP Web Client Login Enumeration checks.

Security researchers have identified that most participating IP addresses share similar TCP fingerprints, strongly indicating a centralized command and control infrastructure orchestrating the campaign.

The attacks specifically focus on US-based RDP services, with participating botnet nodes distributed across diverse geographic regions, including Brazil, Argentina, Iran, China, Mexico, Russia, South Africa, and Ecuador.

GreyNoise’s analysis reveals that the botnet was initially detected after an unusual spike in activity in the Brazilian IP space, prompting investigators to examine broader traffic patterns.

This investigation uncovered additional surges in malicious activity across multiple source countries throughout early October, all exhibiting consistent targeting patterns against American RDP infrastructure.

The shared TCP fingerprinting across geographically dispersed nodes provides strong evidence of coordinated botnet operations under unified control.

Several technical indicators support the assessment that this activity originates from a single botnet operation rather than independent attacks.

The participating IP addresses demonstrate remarkably similar TCP fingerprints, with only the Maximum Segment Size (MSS) values varying between different compromised botnet clusters.

This variation in MSS likely reflects different network configurations of compromised systems within the botnet infrastructure rather than distinct attack operations.

The timing and coordination of the attacks across multiple countries further reinforce the centralized control hypothesis.

The synchronized activation of RDP-specific attack vectors suggests that botnet operators deliberately configured their infrastructure for this particular campaign.

The consistent targeting of US RDP services across all participating nodes indicates strategic coordination rather than opportunistic scanning activity typically associated with independent threat actors.

Organizations can protect themselves against this ongoing campaign through several defensive measures.

GreyNoise has made available its Block service to dynamically filter all IP addresses participating in this botnet activity, with a specific template called “Oct-2025 RDP Botnet Campaign” available for immediate deployment.

Network administrators should implement robust RDP security configurations, including network-level authentication, account lockout policies, and multi-factor authentication requirements.

The campaign’s focus on timing attacks and login enumeration highlights the importance of monitoring RDP access attempts and implementing rate-limiting mechanisms.

Organizations should consider restricting RDP access through VPN solutions and regularly audit user accounts with RDP privileges.

Given the global scale of this botnet operation, security teams should maintain heightened vigilance for RDP-related anomalies and consider temporarily restricting external RDP access where operationally feasible.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today