Cybercriminals are offering remote access to compromised IT systems via RDP for as little as $10, potentially allowing attackers to steal information, destroy systems, deploy ransomware, and more.
McAfee Labs researchers first discovered the sale of RDP credentials on the dark web and underworld forums, and observed that several of the sellers have tens of thousands of compromised systems ready for sale.
RDP is a remote administration tool, and is included in all versions of Windows. It is commonly used for customer support and server administration, over a network (local or not). If it gets into the wrong hands, the results can be devastating. As an example, the researchers gave the SamSam ransomware released earlier in 2018, which is spread via RDP.
Providing RDP access is a big bonus for a hacker, as they don't need to break into the system via phishing emails or otherwise.
The systems for sale range from Windows XP to Windows Server 2012, which are the most common. In addition, the sellers, along with the sale, provide tips and guides on how to avoid being caught by the buyer.
After analyzing the IP addresses of three compromised systems purchased by the researchers, they noticed that the servers were located inside an international airport. Two of the three servers appeared to have three users installed, one of which was an Administrator, believed to be from the airport's security company.
The researchers recommend banning remote RDP administration of the computer and also suggest that server administrators frequently observe the users who use their services, as well as the IPs from which they connect.
