Botnet Brouhaha: 100K IPs Launch RDP Assault on U.S. Networks!
A botnet with 100,000+ IP addresses from over 100 countries is targeting U.S. RDP services, starting October 8. GreyNoise researchers discovered this after noticing unusual Brazilian IP activity. The attack uses RD Web Access timing attacks and RDP web client login enumeration, with most IPs sharing a similar TCP fingerprint.
Hot Take:
Looks like the botnet world is hosting its own international summit, with over 100,000 IPs RSVP-ing to the RDP infiltration party! If only these cybercriminals could put this kind of global coordination to better (and legal) use, we might have solved world peace by now.
Key Points:
– A botnet of over 100,000 IP addresses is attacking U.S. RDP services since October 8, 2025.
– The attack involves RD Web Access timing and RDP web client login enumeration techniques.
– The coordinated attack suggests a single entity is behind this massive botnet.
– Over 100 countries contribute to the botnet, with major IP activity from Brazil.
– Defensive measures include VPNs, MFA, strong passwords, and monitoring login attempts.