Logins for 1.3 million Windows RDP servers collected from hacker market

​The login names and passwords for 1.3 million current and historically compromised Windows Remote Desktop servers have been leaked by UAS, the largest hacker marketplace for stolen RDP credentials.

With this massive leak of compromised remote access credentials, researchers, for the first time, get a glimpse into a bustling cybercrime economy and can use the data to tie up loose ends on previous cyberattacks.

What’s so special about RDP?

Remote Desktop Protocol (RDP) is a Microsoft remote access solution that allows users to remotely access a Windows device’s applications and desktop as if they were sitting in front of the computer.

Due to its prevalent use in corporate networks, cybercriminals have built a thriving economy around selling the stolen credentials for RDP servers.

While you may think that access to a corporate network would be expensive, the reality is that threat actors sell remote desktop accounts for as little as $3 and typically not more than $70.

Once a threat actor gains access to a network, they can perform a variety of malicious activities. These activities include spreading further throughout the network, stealing data, installing point-of-sale (POS) malware to harvest credit cards, installing backdoors for further access, or deploy ransomware.

The use of Windows Remote Desktop Services to breach networks is so pervasive that the FBI has stated that RDP is responsible for 70-80% of all network breaches leading to ransomware attacks.

While all ransomware groups utilize RDP to some extent, one ransomware group known as Dharma is known to predominantly use remote desktop to gain a foothold in corporate networks.

UAS, the largest marketplace for RDP credentials

UAS, or ‘Ultimate Anonymity Services,’ is a marketplace that sells Windows Remote Desktop login credentials, stolen Social Security Numbers, and access to SOCKS proxy servers.

What makes UAS stand out is that it is the largest such marketplace, performs manual verification of sold RDP account credentials, offers customer support, and provides tips on how to retain remote access to a compromised computer.

“The market functions partially like eBay – a number of Suppliers work with the market. They have a separate place to log in and upload the RDPs they hacked. The system will then verify them, collect information about each one (os, admin access? internet speed, cpu, memory etc etc), which is added to the listing.”

“The supplier interface provides real time stats for the suppliers (what sold, what didn’t, what was sold but a refund was asked for, etc).”

“They also provide support if for some reason what you bought doesn’t work. They do take customer support seriously,” a security researcher who wishes to remain anonymous told.

When purchasing stolen RDP accounts, threat actors can search for compromised devices in a particular country, state, city, zip code, ISP, or operating system, allowing them to find the specific server they need.

Potential buyers can dig down deeper on each server to see the number of Windows accounts, the Internet connection speed, the server’s hardware, and more, as shown below.

The marketplace will not sell any servers located in Russia or a Commonwealth of Independent States (CIS) country and runs a script that automatically removes any that are found.

Even with this filtering of servers, UAS is currently selling a massive 23,706 RDP credentials.

Secretly monitoring the UAS marketplace

Since December 2018, a group of security researchers have had secret access to the database for the UAS marketplace and have been quietly collecting sold RDP credentials for almost three years.

During this time period, the researchers have collected the IP addresses, usernames, and passwords, for 1,379,609 RDP accounts that have been sold at UAS since the end of 2018.

This database had been shared with Advanced Intel’s Vitali Kremez, who also shared a redacted copy.

While we will not be listing any of the companies found in the database, we can say that the listed RDP servers are from all over the world, including government agencies from sixty-three countries, with Brazil, India, and the United States being the top three.

There are also RDPs servers for many well-known, high-profile companies, with many servers from the healthcare industry.

Furthermore, found many RDP servers in the database that belong to organizations known to have suffered ransomware attacks over the past two years.

  • The top five login names found in the sold RDP servers are ‘Administrator‘, ‘Admin‘, ‘User‘, ‘test‘, and ‘scanner‘.
  • The top five passwords used by the RDP servers are ‘123456‘, ‘123‘, ‘P@ssw0rd‘, ‘1234‘, and ‘Password1‘.
  • The top five represented countries in the database are United StatesChinaBrazilGermanyIndia, and the United Kingdom.

More complete stats are found at the end of the article.

RDPwned: Checking if your RDP is compromised

Vitali Kremez has launched a new service called RDPwned that allows companies and their admins to check if their servers are listed in the database.

“The marketplace is tied to a number of high-profile breaches and ransomware cases across the globe. A number of ransomware groups are known to purchase initial access on UAS. This treasure trove of adversary-space data provides a lens into the cybercrime ecosystem, and confirm that low hanging fruit, such as poor passwords, and internet-exposed RDP remain one of the leading causes of breaches,”

“RDPwned will also help illuminate old breaches for which they never figured out initial access. For others, it will give them a chance to resolve the security problem before it becomes a breach,” Kremez told.

To use the service, Kremez told that companies would need to submit contact information from an executive or admin of the company, which Advanced Intel will vet.

Once the user’s identity is verified, Advanced Intel will confirm if their company’s servers are listed in RDPwned.

Visitors can perform this lookup via reverse DNS, IP addresses, and domain names.

Further statistics

Below are additional statistics showing the top 20 login names, top 20 passwords, and top 10 countries found in the 1.3 million RDP servers that UAS has listed on the marketplace.

Top 20 login names

Used login nameTotal accounts
Administrator303,702
Admin59,034
User45,096
test30,702
scanner20,876
scan16,087
Guest12,923
IME_ADMIN9,955
user18,631
Administrador8,612
Trader8,608
postgres5,853
IME_USER5,667
Usuario5,236
user24,055
Passv3,989
testuser3,969
test13,888
server3,754
student3,592
reception3,482
backup3,356
openpgsvc3,339
info3,156
VPN3,139

Top 20 passwords

Used passwordTotal accounts
12345671,639
12350,449
P@ssw0rd47,139
123434,825
Password127,007
124,955
password19,148
1234516,522
admin15,587
ffff-ffc0M456x (see note)15,114
Admin@12313,572
User13,437
scanner13,193
scan10,409
test10,169
Aa1234569,399
Password1238,756
123456788,647
Admin1238,214
Passw0rd7,817
admin,.123!@#$%^7,027
1qaz@WSX6,248
Welcome15,962
P@ssword645,522
abc@1234,958

Note: The ‘ffff-ffc0M456x’ password appears to be a default password configured by the MailEnable setup program for remote access. Users are advised to change this password to something else.

Top 10 countries

CountryTotal Accounts
United States299,529
China201,847
Brazil119,959
Germany56,225
India41,588
United Kingdom37,810
France32,738
Spain30,312
Canada27,347
Hong Kong24,804

NOTE:: This article is copyright by bleepingcomputer.com and we are using it for educational or Information purpose only

Best Cyber Security Products & Solutions