Adventures of an RDP Honeypot – Part Two: Know Your Enemy

This report describes a 9.5-day RDP honeypot that recorded over 58,000 authentication attempts and 46 successful logins; attackers deployed Rapid Ransomware (encrypting files and disabling recovery), and later intruders modified RDP to allow persistence, added hidden administrative accounts, created scheduled tasks, and adjusted firewall rules—demonstrating how quickly exposed RDP can lead to ransomware and sustained compromise and including multiple MD5 indicators and procedural details.