Sunday, June 15, 2025
HomeComputer SecurityHackers Abuse RDP Service to Exfiltrate Data and Drop Different Malicious Payloads

Hackers Abuse RDP Service to Exfiltrate Data and Drop Different Malicious Payloads

Published on

SIEM as a Service

Follow Us on Google News

Hackers abuse legitimate RDP service to use fileless attack techniques for dropping multi-purpose off-the-shelf tools for device fingerprinting and to deploy malicious payloads ranging from ransomware to cryptocurrency miners.

The Remote Desktop is the built-in feature with most of the Windows installation and it has built-in file-sharing functionality that is used by the attackers as an infection vector.

Abusing Remote Desktop Server Feature

The infection starts by abusing the feature of the Windows Remote Desktop Server in which the RDP client shares the virtual network file share location named “tsclient” of the connected computer. Attackers use these paths to create multiple-letter directory names.

- Advertisement - Google News
PC Drives

According to Bitdefender researchers report, the attackers placed a malicious component of the attack named worker.exe located on the network share on the “tsclient” network location and it can be executed using explorer.exe or cmd.exe.

The worker.exe component provides an array of commands that includes collecting system information, architecture, CPU model and core count, RAM size, Windows version, taking screenshots, collecting the victim’s IP address and domain name, upload and download speeds, pulling information about default browsers and specific open ports.

The final command includes anti-forensic and detection-evasion purposes, which allows attackers to create Run dialog’s history.

Deploying Malicious Payload

By gathering details about the infected machine allows attackers to decide the type of malicious payload to infect the targeted. If it is an enterprise network attackers may decide to deploy ransomware.

The attackers use an array of payloads starting that include Clipboard stealer payloads, Attributing off the shelf tools, Cryptocurrency stealer, Ransomware payloads, Miner payloads, and AZORult payloads.

The campaign targets the victim’s around the globe, most of the victims in Brazil, the United States, and Romania. the campaign not targeted to any specific industries, it tries to infect possible victims.

Global Distribution

Researchers further distinguish the attack type “miners were used before approximately April 2018, but since then a wide variety of tools were employed, especially until the early months of 2019.”

RDP service
Payload Types

These types of attacks can be thwarted by disabling drive redirection from the list of group policies “Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

North Korean IT Workers Exploit Legitimate Software and Network Tactics to Evade EDR

A North Korean IT worker, operating under a false identity, was uncovered infiltrating a...

Hackers Exploit PyBitmessage Library to Evade Antivirus and Network Security Detection

The AhnLab Security Intelligence Center (ASEC) has uncovered a new strain of backdoor malware...

Europol Launches Taskforce to Combat Violence-as-a-Service Networks

Europol has announced the launch of a powerful new Operational Taskforce (OTF), codenamed GRIMM, to...