Researchers warn of widespread RDP attacks by 100K-node botnet

Researchers warn of widespread RDP attacks by a 100K-node botnet, with GreyNoise tracing a campaign that began on 8 October 2025 targeting Remote Desktop Protocol services in the United States. The botnet is stated to consist of more than 100,000 unique IP addresses from multiple countries, including Brazil, Argentina, Iran, China, Mexico, Russia, South Africa, and Ecuador, among others.

According to GreyNoise, the campaign uses two attack vectors — RD Web Access timing attacks and RDP web client login enumeration — and the firm assesses with high confidence that elevated RDP targeting is the work of a coordinated botnet operated from a centralised control point. The advisory notes that almost all traffic shares a similar TCP fingerprint, suggesting a single entity behind the operation, with MSS variations likely reflecting different botnet clusters.

To defend RDP services, the article recommends restricting access with VPNs or firewalls, enforcing MFA and strong passwords, enabling Network Level Authentication, keeping systems patched, and monitoring login attempts for anomalies.