Hackers Actively Scanning to Exploit Microsoft Remote Desktop Protocol Services From 30,000+ IPs

A massive coordinated scanning campaign observed in August 2025 used over 30,000 unique IPs (with an initial wave of ~2,000 on Aug 21) to probe Microsoft RD Web Access and RDP Web Client for timing-based authentication/username enumeration; activity was heavily concentrated against U.S. educational RDP endpoints and showed uniform client signatures consistent with centralized botnet or APT infrastructure, indicating preparation for credential-based attacks or larger exploitation campaigns.