Ransomware deployments after brute force RDP attack

Fox-IT documents multiple incidents in which attackers brute-forced internet-exposed Remote Desktop Protocol (RDP) servers to gain access, perform prolonged reconnaissance and lateral movement, and ultimately deploy ransomware from compromised servers; this approach increases impact by targeting servers and backups and leads to negotiated, potentially large ransoms. The report explains infection vectors (spam, malvertising, exploit kits, and compromised RDP), impact on networks and backups, and provides concrete prevention, detection and response guidance such as disabling internet-facing RDP, enforcing strong passwords/2FA, secure logging, 24/7 monitoring and engaging incident response.