Windows Remote Desktop Leaves Behind Image Fragments Attackers Can Stitch Into Screenshots

This report warns that Windows' RDP Bitmap Cache saves small image tiles of remote sessions to disk that attackers can compress, exfiltrate, and reconstruct into readable screenshots using free tools (e.g., bmc-tools and RdpCacheStitcher). The write-up describes the attack sequence (locating the cache in user AppData, zipping via PowerShell, exfiltrating over HTTPS, deleting traces), notes threat groups that exploit RDP access, and recommends mitigations such as disabling the cache via Group Policy, monitoring access to the RDP cache folder, alerting on PowerShell compression and outbound HTTPS of archives, and adding cache checks to IR playbooks.