Attention Required! | Cloudflare

Researchers reported a torrent of malicious scans hitting Microsoftundefineds Remote Desktop Protocol (RDP) services, with GreyNoise flagging a surge from nearly 2,000 IP addresses on 21 August 2025 and a second wave on 24 August 2025 involving more than 30,000 IP addresses. According to GreyNoise, the majority of addresses were known to be malicious, and the scans probed both the RDP Web Client authentication portals and the RD Web Access portal.

The activity was directed exclusively at the US, and researchers suggest the education sector could be at particular risk given the timing and common username formats used in campuses. Stone wrote that the telemetry points to a centrally controlled botnet or large residential proxy fleet, possibly operated by a single actor, rather than multiple unaffiliated groups.

Even if no zero-day vulnerability is disclosed, the mass scanning underscores the need for organisations to harden RDP and monitor for follow-up activity tied to the same client signature.