How a Single Exposed RDP Server Can Seed a Botnet, Darktrace Explains

Remote access has become something IT teams cannot do without now that so many people work away from the office. Max Heinemeyer, Director of Threat Hunting at Darktrace, points out that close to five million Remote Desktop Protocol (RDP) servers are now reachable from the internet, roughly two million more than before the pandemic. Most companies depend on remote desktops, and criminals exploit them often. Heinemeyer cites the Florida water plant incident, in which an attacker tried to alter the chemical levels in an entire city's water supply, as an example of how deadly such an attack could be.

Shortly before he wrote, Darktrace caught a server-side attack at a technology company in the APAC region. The attackers brute-forced an RDP server and tried to move through the rest of the organisation. Spotting the breach early, he says, was what stopped them before they could assemble a botnet and use it for serious harm, possibly a ransomware or distributed denial-of-service (DDoS) attack.

What an attacker can do with a botnet

According to Heinemeyer, one weak RDP server is enough for an attacker to get a foothold in an organisation and then move sideways to build up a botnet. A bot is just an infected device that an outside party can control. Once an attacker has a network of them, the options include:

• stealing user credentials and payment data;
• placing Trojan malware on the server, which poses as legitimate software while opening a backdoor into the system;
• deploying ransomware, as happened in a Dharma attack the previous year;
• selling access to the company's infrastructure to other attackers;
• using the CPUs of the zombie devices to mine cryptocurrency.

With remote access to these machines, there is very little an attacker cannot do. Botnet malware usually updates itself, so its owner can add or strip out features. Because the intruders log in with valid administrative RDP credentials, conventional security tools struggle to see anything wrong until the damage is done.

DDoS for hire and botnet builder kits

Heinemeyer notes that the business side of cybercrime has grown fast in recent years, which makes things harder still. The dark web now offers subscription and rental arrangements for all sorts of illegal services, from Ransomware-as-a-Service to auctions of private data. Infecting servers and selling the use of the resulting bots online is therefore increasingly common. DDoS-for-hire services rent out botnets for as little as $20 an hour. Some of these kits are even legal, sold as "IP stressers" or "booters" for legitimately testing how well a website holds up, yet they are frequently abused to knock sites and networks offline.

The money to be made from building botnets and renting them out on the dark web has driven a new wave of DDoS and botnet malware attacks. So-called botnet builder tools supply the malware and help with the first infection, which lets attackers with little skill create bots. By lowering the skill needed, these kits have led to a surge in sophisticated RDP attacks that almost anyone can now carry out.

Inside the automated RDP attack

In the case Darktrace investigated, the victim was a technology company with about 500 devices on its network, and the compromised machine was an internet-facing RDP server hosting an online games site. The attacker brute-forced the password and gained remote access to the desktop. From that point, Darktrace's Cyber AI started flagging unusual administrative RDP connections from rare external locations.

Heinemeyer describes the incident as fairly typical of an RDP compromise. Brute-forcing credentials is a common way into servers, along with credential stuffing and exploiting vulnerabilities. Here the attacker probably intended to use the exposed server as a pivot to infect other devices inside and outside the network, perhaps to build a botnet for hire or to steal sensitive data.

About 14 hours after the break-in, the attacker downloaded several files from rare domains. Over the following 18 hours the server attempted more than 4.4 million internal and external connections on port 445 over the vulnerable SMBv1 protocol. Most of these were SMB session failures using the credential "administrator", but the server did establish SMB sessions with over 270 internal and external IP addresses.

Outbound connections to rare but harmless destinations, on ports usually reserved for internal traffic, may not fit any known attack profile, so signature-based tools miss them. Darktrace had no threat intelligence on the download sources, yet its AI recognised how abnormal the behaviour was and raised high-confidence detections.

Why automation raises the stakes

The speed of the activity, and the fact that no data was taken, suggest the attack was automated, probably with a botnet builder tool. In Heinemeyer's assessment, automation that both speeds up a breach and hides it could have had severe results if the security team had not been alerted early.

Attacks on internet-facing RDP servers are still among the most common ways in. Automated scanning services and botnet malware tools have made compromise far easier, and he considers it only a matter of time before any exposed server is exploited. Highly automated attacks run nonstop and can spread quickly through an organisation, so security teams need to learn about malicious activity on their devices as fast as possible.

By his account, Darktrace's AI worked out unaided that the infection began on a particular RDP server and followed each stage of the attack as it happened, despite the absence of clear signatures. He argues that self-learning AI, which picks up anomalous behaviour by users and devices across the digital environment, is what allows threats to be stopped at machine speed, and that the visibility of the Enterprise Immune System shrinks the attack surface and exposes poorly maintained shadow IT. He credits Darktrace analyst Tom McHale for his work on this threat find.