This question already has an answer here:

I have a pc with static IP bought from my ISP and RDP enabled. I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about it. But I got hacked with a ransomware and all my files are encrypted. Fortunately, I have a backup for everything. But I want to know how the hacker knew that there is a server on that static IP that is not attached to any domain or used by any public products (website, web-service ... etc)

marked as duplicate by Steffen Ullrich, Conor Mancone, Matthew, schroeder Oct 18 '18 at 11:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 5
  • 2
    Ransomware is most commonly spread through email and infected files, not through direct connection to an IP. I would look for other reasons why you got hit by ransomware. – schroeder Oct 18 '18 at 11:53
  • @schroeder I just opened my pc and found there is a job opening a readme file that asks me to contact a strange mail sending them an id (they look to have many victims) if I want to restore my files. I also found all my database and back-end code encrypted (and other files like documents and binaries) I didn't open any mail or such thing on that PC as it's brand new. – Ammar Atef Oct 18 '18 at 11:58
  • 2
    In my opinion, then you have a bigger problem than someone finding your IP. Either someone was able to log into your machine (in which case you should not be restoring files from backup, but rebuilding the machine from scratch and changing the RDP password) or the machine was infected from another source. You still have an open problem on your hands, and it's not an IP. – schroeder Oct 18 '18 at 12:03
  • 2
    As long as you remove the current OS and files, it doesn't matter what you replace them with. – schroeder Oct 18 '18 at 12:13

I was using this PC for development and didn't tell or use it for any communication purpose so it's not possible that someone knew about it

The entire Internet is regularly port scanned, both by malware, attackers and researchers such as shodan.io. You can not expect any service accessible to the Internet to be unidentified for more than seconds after connecting it.

If you make anything available, secure it. Keep it patched. Disable unneeded features, and so on. Protocols that have a high impact and poor security record, such as RDP, should probably not be exposed directly, but shielded via for instance a VPN, or a SSH tunnel, so that the service is not externally accessible.

Your question is like asking why anyone broke into your house, when you didn't advertise the address in the newspaper or phone book: someone saw it there, and decided to break in.

  • 15
    + for a really nice analogy :) – Ben Oct 18 '18 at 10:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.