Global cybersecurity company Kaspersky reports blocking more than 4M Bruteforce attacks eyeing businesses in Bangladesh last year.
From the period of January to December 2023, a total of 4,012,024 Bruteforce.Generic.RDP.* were detected and foiled by Kaspersky B2B products installed in companies of various sizes in the country.
A Bruteforce attack is a method for guessing a password or an encryption key that involves systematically trying all possible combinations of characters until a correct one is found. A successful Bruteforce attack allows an attacker to obtain valid user credentials.
Remote Desktop Protocol (RDP) is Microsoft’s proprietary protocol, providing a user with a graphical interface to connect to another computer through a network.
RDP is widely used by both system administrators and less-technical users to control servers and other PCs remotely.
A Bruteforce.Generic.RDP.* attack attempts to find a valid RDP login / password pair by systematically checking all possible passwords until the correct one is found.
A successful Bruteforce.Generic.RDP.* attack allows an attacker to gain remote access to the targeted host computer.
“Bruteforce attack is not a threat companies should ignore. The use of third-party services for data exchange, employees working on home computers, and potentially insecure Wi-Fi networks, and the use of remote-access tools like RDP remain to be a headache for corporate infosec teams,” explains Adrian Hia, Managing Director for Asia Pacific at Kaspersky.
“We cannot discount that artificial intelligence modules and algorithms can be used to break corporate log-in and password pairs faster. And once threat actors gain remote access to your corporate computers, the possibility of financial and even reputational damage they can do becomes endless. Businesses here should beef up their endpoint and network security posture to defend themselves against smarter AI-based Bruteforce attacks,” he adds.
If users have to rely on RDP in their work, they should ensure taking all possible protection measures which includes, using strong passwords, making RDP available only through a corporate VPN, using Network Level Authentication (NLA), enabling two-factor authentication. Additionally, If RDP is not being used, it should be disabled and port 3389 should be closed.
It is also recommended to use a reliable security solution like Kaspersky Endpoint Security for Business.
Companies are also encouraged to take a step further when it comes to defending their security perimeters. Kaspersky has an integrated software solution that includes a set of functions for event monitoring and management, Kaspersky Unified Monitoring and Analysis Platform (KUMA).
A unified console for monitoring and analysing information security incidents, KUMA can be used as a log management system and as a full-fledged SIEM system.
More information about the platform is available here: https://support.kaspersky.com/help/KUMA/1.5/en-US/217694.htm.
To know more the latest threat reports from Kaspersky, visit Securelist.com.