RDP from an attacker's perspective

Remote Desktop Protocol is widely used for administration and remote work, but it is also a common attack vector. Misconfiguration, weak authentication, unpatched vulnerabilities and public exposure make RDP one of the first services attackers investigate.

Explanation

RDP commonly listens on port 3389 and may be exposed directly to the internet. It attracts brute force, credential stuffing and exploit-based attacks. Compromising a session provides direct system access and opportunities for privilege escalation and lateral movement. Changing the port does not provide meaningful protection.

Risk

Weak or reused credentials make leaked passwords immediately useful. Ransomware groups have used RDP to deploy attacks across environments, while vulnerabilities such as BlueKeep demonstrate the risk of unpatched servers. Malicious access may appear similar to legitimate administration.

Points to check

• Publicly exposed RDP without firewall restrictions.
• Weak or reused credentials without MFA.
• Missing patches for known RDP vulnerabilities.
• No monitoring of unusual times and source locations.
• Limited visibility into sessions and lateral movement.

Approach

Use Network Level Authentication, IP allowlisting, firewall controls and access only through VPN or ZTNA. Restrict RDP rights, log every session, maintain patches and apply segmentation. EDR should detect brute force, lateral movement and suspicious process behaviour following a session.

Conclusion

RDP is powerful but high risk when poorly controlled. Layered protection and deliberate testing turn it from an exposed entry point into controlled administrative access.

Contact

Want to understand the impact in your own environment? Contact DeepBlue Security & Intelligence at info@deepbluesecurity.nl or +31 (0) 70 290 6 290.