Table of Contents
Why RDP Is Heavily Targeted by Attackers
Remote Desktop Protocol (RDP) is Microsoft's built-in tool for remotely controlling Windows computers over a network. It runs on TCP port 3389 by default and provides full graphical desktop access to the remote machine. While RDP is essential for IT administration, remote work, and technical support, it is also one of the most attacked network services on the internet.
Attackers target RDP aggressively because a successful compromise gives them complete control over the target computer, including access to files, installed applications, network resources, and the ability to install malware. Automated scanning tools constantly sweep the internet for systems with port 3389 open, and compromised RDP credentials are actively bought and sold on dark web marketplaces.
According to security researchers, RDP remains one of the top initial access vectors in ransomware attacks. Attackers gain access through weak credentials, then deploy ransomware across the entire network from that single compromised entry point. The combination of widespread deployment and frequent misconfiguration makes RDP a persistent security risk.
Common RDP Attack Methods
Brute Force and Credential Stuffing
The most straightforward RDP attack involves automated tools that try username and password combinations until they find valid credentials. Default usernames like "Administrator," "admin," or "user" combined with common passwords make many RDP servers trivially easy to compromise. Credential stuffing attacks use username-password pairs stolen from data breaches, exploiting the common habit of password reuse. Protect yourself by generating strong, unique passwords with our password generator.
BlueKeep and Protocol Vulnerabilities
BlueKeep (CVE-2019-0708) was a critical vulnerability in older versions of RDP that allowed attackers to execute code remotely without any authentication. While Microsoft patched this vulnerability, it demonstrated that RDP itself can contain exploitable flaws. Subsequent vulnerabilities like DejaBlue extended the risk to newer Windows versions. Keeping your operating system fully patched is non-negotiable when running RDP.
Man-in-the-Middle Attacks
If RDP connections are not properly authenticated, attackers on the same network can intercept the connection and position themselves between the client and server. This allows them to capture credentials, view the session content, and even inject commands. Network Level Authentication (NLA) and proper certificate validation help prevent these attacks.
RDP Session Hijacking
In some configurations, attackers who gain access to a Windows server can hijack existing RDP sessions belonging to other users, including administrators, without needing their credentials. This technique leverages the way Windows manages terminal services sessions and can escalate privileges dramatically.
How to Secure Your RDP Connections
Change the Default Port
Moving RDP from port 3389 to a non-standard port reduces exposure to automated scanning tools that sweep the internet looking for open RDP services. While this is security through obscurity and not a complete solution, it significantly reduces the volume of automated attacks. Choose a high-numbered port (above 10000) and document the change for your team.
Require Network Level Authentication
Network Level Authentication (NLA) requires users to authenticate before a full RDP session is established. Without NLA, the server presents a login screen to anyone who connects, consuming resources and exposing the system to pre-authentication vulnerabilities. With NLA enabled, the connection is authenticated at the network level before the remote desktop session begins, providing a critical layer of protection.
Restrict RDP Access to VPN Users Only
The strongest protection for RDP is to never expose it directly to the internet. Instead, require users to first connect to a Virtual Private Network (VPN) before accessing RDP. This means the RDP port is only accessible from within the private network, and attackers must first compromise the VPN to even reach the RDP service. This single measure eliminates the vast majority of RDP attacks.
Enable Multi-Factor Authentication
Adding MFA to your RDP access ensures that stolen or guessed passwords alone are not sufficient to gain access. Windows supports MFA through various solutions including Azure MFA, Duo Security, and other third-party providers. For organizations, this should be a mandatory requirement for all remote access.
Implement Account Lockout and Rate Limiting
Configure account lockout policies to temporarily disable accounts after a defined number of failed login attempts. A policy that locks accounts for 30 minutes after five failed attempts effectively stops brute force attacks. Combine this with monitoring for patterns that suggest password spraying, where attackers try common passwords across multiple accounts to stay below lockout thresholds.
Keep Systems Patched and Updated
Every Windows security update should be applied promptly, especially those affecting RDP and remote access services. Subscribe to Microsoft's security advisories and prioritize patches marked as critical. The time between a vulnerability disclosure and active exploitation is often measured in days, making prompt patching essential.
Monitoring and Logging RDP Access
Enable comprehensive logging for all RDP connections. Windows Event Viewer records logon events (Event ID 4624), failed logon attempts (Event ID 4625), and session disconnections. Review these logs regularly for unusual patterns such as login attempts from unfamiliar IP addresses, access during unusual hours, and multiple failed attempts followed by a successful login.
For organizations, forward RDP logs to a centralized Security Information and Event Management (SIEM) system that can correlate events and trigger alerts automatically. Individual users should periodically check their event logs and ensure they recognize all recent remote access sessions. Using a hash generator to verify the integrity of system logs can also help detect tampering by attackers who attempt to cover their tracks.
Alternatives to Traditional RDP
If your RDP usage is primarily for occasional remote access rather than server administration, consider more secure alternatives. Tools like remote access solutions with built-in encryption, MFA, and audit logging provide the same functionality with security built into their design. These solutions typically do not require opening inbound ports on your firewall, eliminating the exposure risk entirely.
Securing RDP is not optional for anyone who uses it. The combination of strong authentication, VPN-only access, regular patching, and vigilant monitoring transforms RDP from a liability into a safe remote access tool.
Share this article
Raimundo Coelho
Cybersecurity specialist and technology professor with over 20 years of experience in IT. Graduated from Universidade Estácio de Sá. Writing practical guides to help you protect your data and stay safe in the digital world.
