Thursday, March 28, 2024

Hackers Abuse RDP Service to Exfiltrate Data and Drop Different Malicious Payloads

Hackers abuse legitimate RDP service to use fileless attack techniques for dropping multi-purpose off-the-shelf tools for device fingerprinting and to deploy malicious payloads ranging from ransomware to cryptocurrency miners.

The Remote Desktop is the built-in feature with most of the Windows installation and it has built-in file-sharing functionality that is used by the attackers as an infection vector.

Abusing Remote Desktop Server Feature

The infection starts by abusing the feature of the Windows Remote Desktop Server in which the RDP client shares the virtual network file share location named “tsclient” of the connected computer. Attackers use these paths to create multiple-letter directory names.

PC Drives

According to Bitdefender researchers report, the attackers placed a malicious component of the attack named worker.exe located on the network share on the “tsclient” network location and it can be executed using explorer.exe or cmd.exe.

The worker.exe component provides an array of commands that includes collecting system information, architecture, CPU model and core count, RAM size, Windows version, taking screenshots, collecting the victim’s IP address and domain name, upload and download speeds, pulling information about default browsers and specific open ports.

The final command includes anti-forensic and detection-evasion purposes, which allows attackers to create Run dialog’s history.

Deploying Malicious Payload

By gathering details about the infected machine allows attackers to decide the type of malicious payload to infect the targeted. If it is an enterprise network attackers may decide to deploy ransomware.

The attackers use an array of payloads starting that include Clipboard stealer payloads, Attributing off the shelf tools, Cryptocurrency stealer, Ransomware payloads, Miner payloads, and AZORult payloads.

The campaign targets the victim’s around the globe, most of the victims in Brazil, the United States, and Romania. the campaign not targeted to any specific industries, it tries to infect possible victims.

Global Distribution

Researchers further distinguish the attack type “miners were used before approximately April 2018, but since then a wide variety of tools were employed, especially until the early months of 2019.”

RDP service
Payload Types

These types of attacks can be thwarted by disabling drive redirection from the list of group policies “Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles