Exposed Remote Desktop (RDP)

Layer 4: Transport High risk

How it works

Remote Desktop Protocol lets people control a Windows computer or server from elsewhere. It is convenient, and sometimes a vendor or staff member opens it to the internet to allow remote work. Automated scanners find these open services within hours, and attackers then try leaked, default or weak passwords, or exploit known vulnerabilities in unpatched systems. Changing the port number does little to help, since scanners look for the service rather than a specific port.

Once logged in, an attacker has the same control as someone sitting at the keyboard. They can install tools, disable security software, move to other machines and deploy ransomware. Access to exposed RDP servers is also bought and sold among criminal groups, so a single weak password can lead to an attack by someone who never had to break in themselves.

Warning signs

• Remote Desktop reachable directly from the internet
• Large numbers of failed Windows logon events
• Logins from unexpected countries or at odd hours
• New local administrator accounts
• Remote access set up by a vendor without documentation

How to defend against it

• Never expose RDP directly to the internet
• Place remote access behind a VPN or secure gateway with MFA
• Enable account lockout and strong password policies
• Keep Windows systems fully patched
• Scan your external footprint regularly for open services

If it happens to you

1. Block external RDP access immediately
2. Isolate systems that show signs of intrusion
3. Reset credentials for any accounts that were used
4. Engage incident response to check for further compromise