Logins for 1.3 million Windows RDP servers collected from hacker market

The login names and passwords for 1.3 million current and historically compromised Windows Remote Desktop servers have been leaked by UAS, the largest hacker marketplace for stolen RDP credentials.

With this massive leak of compromised remote access credentials, researchers, for the first time, get a glimpse into a bustling cybercrime economy and can use the data to tie up loose ends on previous cyberattacks.

What’s so special about RDP?

Remote Desktop Protocol (RDP) is a Microsoft remote access solution that allows users to remotely access a Windows device’s applications and desktop as if they were sitting in front of the computer.

Due to its prevalent use in corporate networks, cybercriminals have built a thriving economy around selling the stolen credentials for RDP servers.

While you may think that access to a corporate network would be expensive, the reality is that threat actors sell remote desktop accounts for as little as $3 and typically not more than $70.

Once a threat actor gains access to a network, they can perform a variety of malicious activities. These activities include spreading further throughout the network, stealing data, installing point-of-sale (POS) malware to harvest credit cards, installing backdoors for further access, or deploy ransomware.

The use of Windows Remote Desktop Services to breach networks is so pervasive that the FBI has stated that RDP is responsible for 70-80% of all network breaches leading to ransomware attacks.

While all ransomware groups utilize RDP to some extent, one ransomware group known as Dharma is known to predominantly use remote desktop to gain a foothold in corporate networks.

UAS, the largest marketplace for RDP credentials

UAS, or ‘Ultimate Anonymity Services,’ is a marketplace that sells Windows Remote Desktop login credentials, stolen Social Security Numbers, and access to SOCKS proxy servers.

What makes UAS stand out is that it is the largest such marketplace, performs manual verification of sold RDP account credentials, offers customer support, and provides tips on how to retain remote access to a compromised computer.

“The market functions partially like eBay – a number of Suppliers work with the market. They have a separate place to log in and upload the RDPs they hacked. The system will then verify them, collect information about each one (os, admin access? internet speed, cpu, memory etc etc), which is added to the listing.”

“The supplier interface provides real time stats for the suppliers (what sold, what didn’t, what was sold but a refund was asked for, etc).”

“They also provide support if for some reason what you bought doesn’t work. They do take customer support seriously,” a security researcher who wishes to remain anonymous told BleepingComputer.

When purchasing stolen RDP accounts, threat actors can search for compromised devices in a particular country, state, city, zip code, ISP, or operating system, allowing them to find the specific server they need.

Potential buyers can dig down deeper on each server to see the number of Windows accounts, the Internet connection speed, the server’s hardware, and more, as shown below.

BleepingComputer was told that the marketplace will not sell any servers located in Russia or a Commonwealth of Independent States (CIS) country and runs a script that automatically removes any that are found.

Even with this filtering of servers, UAS is currently selling a massive 23,706 RDP credentials.

Secretly monitoring the UAS marketplace

Since December 2018, a group of security researchers have had secret access to the database for the UAS marketplace and have been quietly collecting sold RDP credentials for almost three years.

During this time period, the researchers have collected the IP addresses, usernames, and passwords, for 1,379,609 RDP accounts that have been sold at UAS since the end of 2018.

This database had been shared with Advanced Intel’s Vitali Kremez, who also shared a redacted copy with BleepingComputer to review.

While we will not be listing any of the companies found in the database, we can say that the listed RDP servers are from all over the world, including government agencies from sixty-three countries, with Brazil, India, and the United States being the top three.

There are also RDPs servers for many well-known, high-profile companies, with many servers from the healthcare industry.

Furthermore, BleepingComputer has found many RDP servers in the database that belong to organizations known to have suffered ransomware attacks over the past two years.

After analyzing the 1.3 million accounts in the database, BleepingComputer has pulled out some interesting data that should be useful for all computer users and network admins:

• The top five login names found in the sold RDP servers are ‘Administrator‘, ‘Admin‘, ‘User‘, ‘test‘, and ‘scanner‘.
• The top five passwords used by the RDP servers are ‘123456‘, ‘123‘, ‘P@ssw0rd‘, ‘1234‘, and ‘Password1‘.
• The top five represented countries in the database are United States, China, Brazil, Germany, India, and the United Kingdom.

More complete stats are found at the end of the article.

RDPwned: Checking if your RDP is compromised

Vitali Kremez has launched a new service called RDPwned that allows companies and their admins to check if their servers are listed in the database.

“The marketplace is tied to a number of high-profile breaches and ransomware cases across the globe. A number of ransomware groups are known to purchase initial access on UAS. This treasure trove of adversary-space data provides a lens into the cybercrime ecosystem, and confirm that low hanging fruit, such as poor passwords, and internet-exposed RDP remain one of the leading causes of breaches,”

“RDPwned will also help illuminate old breaches for which they never figured out initial access. For others, it will give them a chance to resolve the security problem before it becomes a breach,” Kremez told BleepingComputer.

To use the service, Kremez told BleepingComputer that companies would need to submit contact information from an executive or admin of the company, which Advanced Intel will vet.

Once the user’s identity is verified, Advanced Intel will confirm if their company’s servers are listed in RDPwned.

Visitors can perform this lookup via reverse DNS, IP addresses, and domain names.

Further statistics

Below are additional statistics showing the top 20 login names, top 20 passwords, and top 10 countries found in the 1.3 million RDP servers that UAS has listed on the marketplace.

Top 20 login names

Top 20 passwords

Note: The ‘ffff-ffc0M456x’ password appears to be a default password configured by the MailEnable setup program for remote access. Users are advised to change this password to something else.

Top 10 countries

Source: https://www.bleepingcomputer.com/news/security/logins-for-13-million-windows-rdp-servers-collected-from-hacker-market/