There is a significant surge in scanning activities targeting Remote Desktop Protocol (RDP) services, with a particular focus on port 1098/TCP.

Over the past two weeks, honeypot sensors have detected an alarming increase in these scans, with up to 740,000 distinct source IP addresses daily, including a staggering 405,000 originating from Brazil, Shadowserver Foundation observed.

We are seeing large numbers of sources scanning for RDP services – especially port 1098/TCP (!) – in our honeypot sensors last 2 weeks (up to 740 000 (!) distinct source IPs daily, incl up to 405 000 from Brazil).

Tracker: https://t.co/KVQL03FvHG

Map: https://t.co/iEnhb8uhpP pic.twitter.com/4KglfJVWgv
— The Shadowserver Foundation (@Shadowserver) December 13, 2024

This aggressive scanning campaign highlights the ongoing threat landscape surrounding RDP services, which have long been a favored target for cybercriminals due to their widespread use and potential vulnerabilities.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

The unusual focus on port 1098, typically associated with other services, suggests that attackers may be exploiting misconfigurations or seeking to bypass traditional security measures.

The timing of this scanning activity is particularly noteworthy, as it follows closely on the heels of Microsoft’s recent Patch Tuesday release.

The December 2024 update addressed multiple critical RDP vulnerabilities, including CVE-2024-49106, CVE-2024-49108, CVE-2024-49115, CVE-2024-49119, CVE-2024-49120, CVE-2024-49123, CVE-2024-49132, CVE-2024-49116, and CVE-2024-49128.

Here’s a table summarizing the CVEs related to Remote Desktop Services vulnerabilities from Microsoft’s December 2024 Patch Tuesday:

CVE Number	Severity	CVSS Score	Description
CVE-2024-49106	Critical	8.1 (High)	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49108	Critical	8.1 (High)	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49115	Critical	8.1 (High)	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49116	Critical	Not Specified	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49119	Critical	Not Specified	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49120	Critical	8.1 (High)	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49123	High	8.1	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49128	Critical	Not Specified	Remote Code Execution in Windows Remote Desktop Services
CVE-2024-49132	High	8.1	Remote Code Execution in Windows Remote Desktop Services

All these vulnerabilities affect Windows Remote Desktop Services and pose significant security risks if left unpatched. Organizations should prioritize applying the latest security updates to mitigate these threats.

If left unpatched, these vulnerabilities could allow attackers to execute remote code on affected systems.

Security experts warn that misconfigured RDP services can give attackers a dangerous foothold into target networks. Beyond gaining unauthorized access to vulnerable hosts, attackers can also gather valuable information about target systems.

The SSL certificates used by RDP often contain the system’s hostname, providing attackers with additional reconnaissance data.

In light of these threats, organizations are strongly advised to take immediate action to secure their RDP services. Key recommendations include:

Limiting unnecessary exposure of RDP services to the internet.
Enabling Multi-Factor Authentication (MFA) for all RDP connections.
Ensuring all systems are promptly patched with the latest security updates.
Implementing strong password policies and account lockout measures.
Network Level Authentication (NLA) is used to add an extra layer of pre-authentication security.

Furthermore, IT security teams are urged to investigate any reports of RDP scanning or exploitation attempts promptly. The source IP addresses involved in these activities may indicate compromised systems being used as part of a larger attack infrastructure.

As remote work continues to be a significant part of many organizations’ operations, securing RDP and other remote access technologies remains critical.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

The post Hackers Scanning RDP Services Especially Port 1098 For Exploitation appeared first on Cyber Security News.