Monday, February 10, 2025
HomeComputer SecurityHackers Abuse RDP Service to Exfiltrate Data and Drop Different Malicious Payloads

Hackers Abuse RDP Service to Exfiltrate Data and Drop Different Malicious Payloads

Published on

SIEM as a Service

Follow Us on Google News

Hackers abuse legitimate RDP service to use fileless attack techniques for dropping multi-purpose off-the-shelf tools for device fingerprinting and to deploy malicious payloads ranging from ransomware to cryptocurrency miners.

The Remote Desktop is the built-in feature with most of the Windows installation and it has built-in file-sharing functionality that is used by the attackers as an infection vector.

Abusing Remote Desktop Server Feature

The infection starts by abusing the feature of the Windows Remote Desktop Server in which the RDP client shares the virtual network file share location named “tsclient” of the connected computer. Attackers use these paths to create multiple-letter directory names.

PC Drives

According to Bitdefender researchers report, the attackers placed a malicious component of the attack named worker.exe located on the network share on the “tsclient” network location and it can be executed using explorer.exe or cmd.exe.

The worker.exe component provides an array of commands that includes collecting system information, architecture, CPU model and core count, RAM size, Windows version, taking screenshots, collecting the victim’s IP address and domain name, upload and download speeds, pulling information about default browsers and specific open ports.

The final command includes anti-forensic and detection-evasion purposes, which allows attackers to create Run dialog’s history.

Deploying Malicious Payload

By gathering details about the infected machine allows attackers to decide the type of malicious payload to infect the targeted. If it is an enterprise network attackers may decide to deploy ransomware.

The attackers use an array of payloads starting that include Clipboard stealer payloads, Attributing off the shelf tools, Cryptocurrency stealer, Ransomware payloads, Miner payloads, and AZORult payloads.

The campaign targets the victim’s around the globe, most of the victims in Brazil, the United States, and Romania. the campaign not targeted to any specific industries, it tries to infect possible victims.

Global Distribution

Researchers further distinguish the attack type “miners were used before approximately April 2018, but since then a wide variety of tools were employed, especially until the early months of 2019.”

RDP service
Payload Types

These types of attacks can be thwarted by disabling drive redirection from the list of group policies “Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

NetSupport RAT Grant Attackers Full Access to Victims Systems

The eSentire Threat Response Unit (TRU) has reported a significant rise in incidents involving...

Quishing via QR Codes Emerging as a Top Attack Vector Used by Hackers

QR codes, once a symbol of convenience and security in digital interactions, have become...

New ‘BYOTB’ Attack Exploits Trusted Binaries to Evade Detection, Researchers Reveal

A recent cybersecurity presentation at BSides London 2024 has unveiled a sophisticated attack technique...

SAML Bypass Authentication on GitHub Enterprise Servers to Login as Other User Account

A severe security vulnerability, tracked as CVE-2025-23369, has been identified in GitHub Enterprise Server...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Hackers Exploit 3,000 ASP.NET Machine Keys to Hack IIS Web Servers Remotely

Microsoft has raised alarms about a new cyber threat involving ViewState code injection attacks...

Is this Website Safe: How to Check Website Safety – 2025

is this website safe? In this digital world, Check a website is safe is...

NFS Protocol Security Bypassed To Access Files From Remote Server

The NFS protocol offers authentication methods like AUTH_SYS, which relies on untrusted user IDs,...