Massive RDP Botnet Unleashed: 100,000+ IPs in Coordinated Global Scanning Campaign Targeting US

According to GreyNoise Intelligence, a massive coordinated botnet operation targeting Remote Desktop Protocol (RDP) services across the United States has been observed, with more than 100,000 unique IP addresses involved since 8 October 2025. The campaign focuses on U.S.-based RDP endpoints and spans over 100 countries, including Brazil, Argentina, Iran, China, Mexico, Russia, and South Africa.

Two specific RDP attack vectors are being used: Microsoft RD Web Access Anonymous Authentication Timing Attack Scanner and Microsoft RDP Web Client Login Enumeration Check. Researchers note that almost all participating IPs share one similar TCP fingerprint, indicating centralised control of a single botnet infrastructure. The activity appears to be multi-country yet highly synchronised, with a consistent technical fingerprint across participating systems.

While no specific malware family has been attributed, GreyNoise concludes that the elevated RDP targeting beginning this week is part of a multi-country botnet campaign.