0

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to remote server “ which obviously raised alarms so I began checking my event logs and found a third parties IP had connected successfully, shortly after removing all my content from the server it was then infected with ransomware..

I’m still unsure as to what the cause was behind the intrusion as I was using a random generated string of roughly 28 characters for my password if I remember correctly.. The ransomware stated I was infected due to security flaws and I was to pay a said amount, however I’m not sure one would believe the automated message injected by a hacker..

So now it’s 2 weeks or so later and I’ve changed my server provider along with a new random generated password in a new location under a new ip and then the same thing occurred today I was disconnected and prompted with “ Another user has connected to the remote server “ as of yet no malware has been executed inside the server, but I’m sure something will occur as it has most likely been compromised..

Now my initial thoughts are bruteforce attacks against my rdp since audit logs suggest numerous failed attempts per second, however would someone even attempt to crack a random generated password of 20+ characters or even less? How efficient would that be? I’m not familiar with rdp brute force but I assume it would be rather tedious against random generated passwors.

Both servers were running Windows 2012 R2 Standard, which lead me to believe potential 0days/vulnerabilities but the most recent “ Bluekeep “ isn’t compatible with Windows 2012 and I couldn’t find any recent vulnerabilities regarding Windows 2012..

I’m unsure of how this keeps occurring, so looking for potential answers, of course I understand there’s multiple possibilities but I’m looking to pin point the most likely scenario.

Also just as a FYI my emails show no third party ligs, my rdp providers cPanel shows no third party logs and according to the providers themselves they are incapable of even viewing my custom password it’s only possible to force a reset, which isn’t happening in this case so I don’t believe the providers themselves are compromised.

Improve this question
2
  • Unless you are a very important person, I doubt a hacker burned a zero day on you. My guess is your client machine is compromised, e.g. if there were a keylogger then a malicious user would not only know your 28-character password but any new passwords you set up, along with the information for your new server.
    – John Wu
    Commented Aug 7, 2019 at 0:29
  • @John Wu my client machine ( the one I use to connect and set credentials ) has been checked for malicious content such as malware but nothing was found, I’ve used Malwarebytes, Intego and even had a check up from the Malwarebytes community using tools such as farbar and rkill etc but nothing was found and even so I done a format and reinstall before setting up a new vps and applying custom credentials.
    – user213965
    Commented Aug 7, 2019 at 13:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .