So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to remote server “ which obviously raised alarms so I began checking my event logs and found a third parties IP had connected successfully, shortly after removing all my content from the server it was then infected with ransomware..
I’m still unsure as to what the cause was behind the intrusion as I was using a random generated string of roughly 28 characters for my password if I remember correctly.. The ransomware stated I was infected due to security flaws and I was to pay a said amount, however I’m not sure one would believe the automated message injected by a hacker..
So now it’s 2 weeks or so later and I’ve changed my server provider along with a new random generated password in a new location under a new ip and then the same thing occurred today I was disconnected and prompted with “ Another user has connected to the remote server “ as of yet no malware has been executed inside the server, but I’m sure something will occur as it has most likely been compromised..
Now my initial thoughts are bruteforce attacks against my rdp since audit logs suggest numerous failed attempts per second, however would someone even attempt to crack a random generated password of 20+ characters or even less? How efficient would that be? I’m not familiar with rdp brute force but I assume it would be rather tedious against random generated passwors.
Both servers were running Windows 2012 R2 Standard, which lead me to believe potential 0days/vulnerabilities but the most recent “ Bluekeep “ isn’t compatible with Windows 2012 and I couldn’t find any recent vulnerabilities regarding Windows 2012..
I’m unsure of how this keeps occurring, so looking for potential answers, of course I understand there’s multiple possibilities but I’m looking to pin point the most likely scenario.
Also just as a FYI my emails show no third party ligs, my rdp providers cPanel shows no third party logs and according to the providers themselves they are incapable of even viewing my custom password it’s only possible to force a reset, which isn’t happening in this case so I don’t believe the providers themselves are compromised.