Threat Actors Deploying New IPs Daily to Attack Microsoft RDP
Summary: GreyNoise reports steady deployments of previously unseen IPs attacking Microsoft RDP through timing-based vulnerabilities, targeting RD Web Access timing attacks and RDP web client login enumeration while rotating significant volumes of new IPs daily to evade detection and blocking. From September 2025 to the present, unique IPs targeting RDP have risen past 500,000, with nearly 100 percent of targeting directed at U.S.-based systems and source and target patterns consistent with botnet activity GreyNoise partially linked to a global botnet on 10 October.
What's compelling: More than 500,000 unique IPs have hit RDP since September 2025, and the daily churn of new addresses is designed to defeat the static blocklists most teams rely on - nearly all of it aimed at U.S. systems.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026