Read enough ransomware incident reports and one line keeps showing up: “initial access was gained through an internet-exposed RDP (Remote Desktop Protocol, port 3389) endpoint.” RDP itself isn’t a broken protocol, but the moment you leave that port open to the public internet, you’re on the radar of every scanner on earth. From an attacker’s perspective, RDP is an unusually efficient way in — crack the login once, and you own the whole screen.
Why RDP Specifically Gets Targeted
A successful RDP login hands over the desktop, the files, and every installed program on that machine — no exploit chain required, unlike attacking a web app’s vulnerability. One working credential is effectively equivalent to admin access on that box. On top of that, servers with port 3389 exposed to the internet are trivially easy to find using scanning search engines like Shodan, which makes them both easy to locate and highly rewarding once cracked — an attacker’s ideal combination.
The Attack Pattern, as Commonly Documented
- Scanning — attackers run automated internet-wide scans to build a list of IPs with port 3389 open.
- Brute-force attempts — automated tools cycle through common username/password combinations until one works.
- Reused stolen credentials — username/password pairs leaked from unrelated breaches circulate and get traded on dark web markets, and are commonly tried against RDP logins directly — this works because of password reuse.
- Initial access brokering — it’s widely reported that once a working login is confirmed, that access itself gets resold to other threat actors as a commodity.
- Lateral movement and execution — the group that buys the access disables security tools, deletes backups, and deploys ransomware — a pattern that shows up consistently across breach reports.
In other words, RDP compromise usually isn’t one clever hack — it’s an assembly line: scan, crack, resell access, deploy ransomware, each step often run by a different group.
How to Actually Defend Against It
- Don’t expose the RDP port directly to the internet. Put it behind a VPN or a dedicated gateway instead of leaving 3389 open on a public IP.
- Turn on multi-factor authentication (MFA). Even a cracked password won’t get an attacker in if a second factor is required.
- Enable account lockout policies. Locking an account after repeated failed logins guts the efficiency of brute-force tools.
- Clean up unused accounts. Renaming the default Administrator account and removing former employees’ or dormant accounts is basic hygiene that gets skipped surprisingly often.
- Consider switching to remote control SaaS. Since it only needs an outbound connection to share a screen, there’s no inbound port left for scanners or brute-force tools to find in the first place — it removes the attack surface at the source.
The Bottom Line
This isn’t an argument against using RDP — it’s an argument against leaving its port open to the raw internet. Given that leaked credentials from unrelated breaches routinely get recycled against RDP logins, and that working access is bought and sold as its own commodity once compromised, the two things worth prioritizing when you design a remote access setup are: how well you can hide the port, and how many layers of verification stand between an attacker and a successful login. For organizations running remote work, outsourced staff, or multiple locations that depend on remote access every day, this isn’t optional — it’s the baseline.
If you run into this often, it’s worth checking out Y-Remote, a browser-based remote control SaaS that needs no VPN or port forwarding.