Ransomware Delivered Using RDP Brute-Force Attack

This report analyzes Dharma (Crysis) ransomware spread via exposed RDP services and brute-force access, detailing the infection chain (port scanning, credential access, backup deletion, payload deployment), technical behaviors (vssadmin shadow deletion, AES-256 + RSA-1024 encryption, file naming pattern, ransom notes), persistence and lateral movement techniques (copying to Startup/Run keys, use of Mimikatz and credential theft, potential GPO abuse), and recommended mitigations such as removing RDP from public exposure, enforcing strong passwords, and adopting zero-trust access controls.