Malicious Scanning Waves Slam Remote Desktop Services

Threat intelligence from GreyNoise and reporting indicate two massive RDP scanning waves (Aug 21 and Aug 24) originating from thousands of IPs—largely consumer ISPs concentrated in Latin America—targeting US endpoints and probing Microsoft RD Web Access/RDP Web Client authentication flows to enumerate usernames and test for timing flaws that could presage a zero-day; the activity likely reflects a centrally controlled botnet or large proxy fleet and elevates the risk of credential-stuffing, password spraying, and follow-on intrusions against primarily education-sector targets.