Exposed Remote Desktop (RDP) on the public internet
The short version: A Remote Desktop (RDP) service exposed to the public internet gives attackers a login prompt for interactive access to your Windows machines — and they hammer it continuously with common, default, and already-breached credentials until one works.
What you need to know
There's no CVE here and nothing to patch — the weakness is the exposure itself. RDP is designed for interactive remote control of a Windows desktop or server. Put that login on the public internet and you've handed anyone who finds it a place to try passwords, all day, from anywhere.
- How they find it — internet-wide scanning constantly catalogs open RDP (typically TCP 3389); an exposed service is found within hours of going live.
- How they use it — automated brute-force and low-and-slow password spraying with common, default, and previously-breached credentials, staying under lockout thresholds.
- What it leads to — one working credential yields interactive access to the host, and from there an attacker can move laterally and escalate. Exposed RDP is one of the most common initial-access vectors for ransomware, which is why the guidance is consistent: don't expose it directly at all.
How serious we see it
High. Unlike a purpose-built VPN or web portal, RDP isn't meant to face the open internet — an exposed RDP login is an interactive foothold waiting for a single guessed or reused password, and it's a documented favorite of ransomware operators. The severity eases if the service is locked to trusted networks and every account is protected by MFA and strong, unique credentials — but as a rule, an internet-facing RDP prompt is an exposure to close, not to monitor. The reassuring part: it's entirely in your hands to fix, with no vendor patch required.
What to do
- Get RDP off the public internet — put it behind a VPN or a Remote Desktop Gateway, and restrict access to trusted IP addresses.
- Enforce MFA — require multi-factor authentication for remote access; it defeats spraying even when a password is known.
- Enforce Network Level Authentication (NLA) and strong, unique passwords — and check them against known-breached lists.
- Limit and monitor failed logins — rate-limit attempts, enforce lockouts, and alert on brute-force and spray patterns.
- Confirm your exposure first — verify whether any RDP service is reachable from the internet today.
How BreachRisk sees it
BreachRisk discovers exposed RDP the way an attacker would — by scanning your external footprint for reachable Remote Desktop services and flagging them as a verified exposure, not a maybe. Because RDP shouldn't be internet-facing in the first place, simply confirming it's reachable is the finding that matters: "we have RDP on the internet" becomes a clear, prioritized item to close before it becomes someone's front door.