Cyber: How A Brute Force Attack Unmasked A Ransomware Infrastructure Network

To most defenders, another brute-force alert on exposed RDP is background noise — bread-and-butter activity you triage and move past. For the Huntress Tactical Response Team, one of those “routine” alerts turned into something very different.

As we pulled on a single successful login, we uncovered unusual credential-hunting behavior, a web of geo-distributed infrastructure, and a shady VPN service that all pointed toward a ransomware-as-a-service ecosystem and its initial access brokers.

This post walks through how a noisy brute-force campaign became our doorway into that operation.

In this case, a network was exposing a Remote Desktop (RDP)  server to the broader internet. We’ve talked about the dangers of this dynamic through different webinars, blogs and social media posts, yet often businesses have no choice but to expose RDP for a myriad of reasons.

In this instance, our SOC received an alert for some domain enumeration and got to work.

Hacking isn’t a solo sport. Cybercriminals work at scale, using the same tools you do and operating like a business.

On March 18, Huntress’ John Hammond and YouTuber Jim Browning give you an inside look at cybercrime’s dark economy

Although intrusions are often written about in a linear fashion, neatly mapped to frameworks like ATT&CK, the reality is that analysts often receive signals for intrusions that are normally found in the “middle” of a threat actor's kill chain. This means that once a signal is received, we have to work both backwards and forwards in time to find both the source of the intrusion as well as any go-forward attack paths.

In this case, upon investigation of the Windows event logs for the affected hosts, we discovered that the RDP service was being brute forced.

Although brute forcing is considered a “bread and butter” type attack technique, investigation of brute force attacks, particularly in networks with default logging configurations, can get a little tricky. Often, recorded login attempts fill up the log channels with security-relevant telemetry being overwritten or discarded.

Source: BleepingComputer