Waspadai RDP Rentan: Password Spray Menjadi Jalan Masuk Ransomware
July 6, 2025
Deskripsi
1
| |
|
|
| |
Dalam sebuah insiden intrusi yang baru-baru ini dianalisis oleh The DFIR Report, pelaku berhasil mendapatkan akses ke sistem sebuah organisasi melalui serangan password spraying terhadap Remote Desktop Protocol (RDP) server yang terekspos ke internet, hal tersebut mengakibatkan threat actor dapat melakukan lateral movement, persistence, hingga instalasi ransomware. Intrusi ini hanya membutuhkan sekitar 118 jam selama enam hari kalender.
|
|
| |
|
|
Timeline Analysis Case DFIR Report
2
| Hour |
Attacker Milestone |
Key Tools/Tactics |
| 0 - 4 hrs |
Password spray to RDP Server from 2 malicious IP, then get six accounts valid. |
Initial access – Valid Domain Accounts |
| 4 – 6 hrs |
Threat actor login with one of the valid account that has admin privileges, then extract stored credentials. |
Elevated token session, Mimikatz, Nirsoft |
| 6 – 30 hrs |
Lateral movement to DCs and file servers. |
Net, Nltest, Netscan Advanced IP Scanner |
| 30 – 70 hrs |
Persistence tools and changing multiple users passwords. |
Atera, Splashtop |
|
70 – 90 hrs
|
Data exfiltration over SFTP (port 443). |
Rclone |
| 90 –118 hrs |
Deploy RansomHub binary (amd64.exe) via SMB.
|
Shadow‑copy wipe, log clearing |
Indicator of Compromise
3
| |
|
|
| |
- RDP Password Spray: Source IP Address yang digunakan threat actor dalam melakukan RDP Spray -> 185.190.24.54, 185.190.24.33
-
RDP Initial Access: Source IP Address yang digunakan threat actor untuk masuk pertama kali ke target -> 164.138.90.2
- Exfiltration Destination: Destination IP Address yang digunakan threat actor untuk mengirimkan data hasil eksfiltrasi -> 38.180.245.207:443
|
|
| |
|
|
Mitigasi
4
| |
|
|
| |
- Nonaktifkan akses RDP dari internet.
-
Disarankan menggunakan MFA pada semua layanan remote access.
- Terapkan strong password dan account lockout policy.
- Pastikan telah menerapkan detection system di level network dan aplikasi seperti Suricata, Sigma dan YARA.
|
|
| |
|
|
Referensi:
- https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
- https://www.webasha.com/blog/how-do-rdp-servers-get-hacked-password-spray-attack-leads-to-ransomhub-ransomware-breach-case-study
- https://cybersecuritynews.com/ransomhub-ransomware-rdp-servers/
