Nearly 2,000 Malicious IPs Probe Microsoft Remote Desktop in Single-Day Surge

Summary: On August 21, GreyNoise observed nearly 2,000 IPs, most previously tagged as malicious, simultaneously probing Microsoft RD Web Access and Microsoft RDP Web Client authentication portals to test for timing flaws that reveal valid usernames. GreyNoise later reported that on August 24, over 30,000 unique IPs triggered both tags at once, largely from the same client signature behind the August 21 spike.
Why it matters: The campaign's US-only targeting lines up with the back-to-school window, when universities and K-12 bring RDP-backed labs online with predictable username formats like student IDs and firstname.lastname, and GreyNoise notes that in 80 percent of cases a new vulnerability emerged within six weeks of an activity spike.

Read the original at GreyNoise Blog ↗