“conduct espionage, deploy ransomware, and run global exploit campaigns : - espionage — russia - nexus actor abusing rdp features for data theft : google threat analysis group ( tag ) reported a suspected russia - nexus espionage actor ( unc5839 ) abusing lesser - known rdp capabi…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1021.001Remote Desktop Protocol
79%
“##s leak information via timing ( or other login - flow differences ) that lets an attacker infer valid usernames. this is enumeration : confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success. why…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1110.004Credential Stuffing
76%
“##s leak information via timing ( or other login - flow differences ) that lets an attacker infer valid usernames. this is enumeration : confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success. why…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1110.003Password Spraying
54%
“##s leak information via timing ( or other login - flow differences ) that lets an attacker infer valid usernames. this is enumeration : confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success. why…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1021.001Remote Desktop Protocol
49%
“nearly 2, 000 malicious ips probe microsoft remote desktop after single - day surge update : 25 august 2025 hours after publishing this blog, greynoise identified a much larger wave : on august 24, over 30, 000 unique ips simultaneously triggered both microsoft rd web access and …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1563.002RDP Hijacking
45%
“conduct espionage, deploy ransomware, and run global exploit campaigns : - espionage — russia - nexus actor abusing rdp features for data theft : google threat analysis group ( tag ) reported a suspected russia - nexus espionage actor ( unc5839 ) abusing lesser - known rdp capabi…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1110Brute Force
44%
“##s leak information via timing ( or other login - flow differences ) that lets an attacker infer valid usernames. this is enumeration : confirming accounts on exposed systems so later credential stuffing, password spraying, or brute force has a much higher chance of success. why…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1563.002RDP Hijacking
36%
“nearly 2, 000 malicious ips probe microsoft remote desktop after single - day surge update : 25 august 2025 hours after publishing this blog, greynoise identified a much larger wave : on august 24, over 30, 000 unique ips simultaneously triggered both microsoft rd web access and …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
On August 21, GreyNoise observed a sharp surge in scanning against Microsoft Remote Desktop (RDP) services. The wave’s aim was clear: test for timing flaws that reveal valid usernames, laying the groundwork for credential-based intrusions.