Hide Your RDP: Password Spray Leads to RansomHub Deployment
Essential information
- Published
- 30/06/2025 18:49
- Modified
- 01/07/2025 08:16
- Tags
- 2025-06-30 credential-theft data exfiltration lateral movement living-off-the-land mimikatz password spray ransomhub ransomware rdp
- Related entities
- 9 observables, 1 intrusion sets (apt), 25 techniques (mitre), 2 malware
Description
This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery. The attackers utilized Rclone for data exfiltration via SFTP and deployed RansomHub ransomware across the network using SMB and remote services. The intrusion lasted six days, culminating in widespread encryption and ransom demands. Key phases included initial access, lateral movement, credential theft, data exfiltration, and ransomware deployment, demonstrating a sophisticated and multi-staged attack methodology.