100,000+ IP Botnet Launches Coordinated RDP Attack Wave Against US Infrastructure
Summary: Since October 8, 2025, GreyNoise has tracked a coordinated botnet operation of over 100,000 unique IP addresses from more than 100 countries targeting Remote Desktop Protocol services in the United States, and the botnet has since grown to roughly 300,000 IPs. The campaign uses two attack vectors, RD Web Access timing attacks and RDP web client login enumeration, with most participating IPs sharing one similar TCP fingerprint, indicating centralized control.
Why it matters: The botnet has more than tripled to about 300,000 IPs and is rapidly activating new nodes, so static blocklists will not keep pace with an operation that already draws on IPs from Brazil, Argentina, Singapore and elsewhere.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026