Russia Digs your RDP Servers and other RDP Scanning

We have been observing quite a large number of RDP probes today over most of our sensors.

It appears as though Russian actors are looking for RDP servers on common ports as well as uncommon ports. While it's never a good idea to put your RDP servers on the network where they are Internet facing, we are seeing them hit cloud providers, hosting companies and other networks of US and foreign networks pretty heavily. Normally they are a little more quiet about it so this looks like an attempt to just round up as many RDP servers as possible.

For recommendations on how to protect your IoT devices and Windows based servers you can view the resources here.

Update: After posting this we started seeing more RDP probes from and which we have not seen before making lots of request. In addition below are some of the more recent examples of host searching for Internet based RDP servers.


Contact: (800)447-2150 Ext. 1        To contact Jigsaw simply send a message in our chat window!

  • Facebook - Black Circle
  • Twitter - Black Circle

© 2017-2018 Jigsaw Security Enterprise Inc.

Jigsaw Security Enterprise Inc is a SDVOSB - Service Connected Disabled Veteran Owned Small Business Jigsaw Security is an operator of WIMAX networks and is operating under license WQVC235 as a common carrier, non-common carrier and private communications operator. Jigsaw Security operates cable and satellite services. Courses may be provided by a third party authorized training partner in some cases. Some training is only available for cleared and US Citizens. Courses approved by the North Carolina Department of Public Safety Private Protective Services Board for licensing and CE credits. JPM program insurance is provided by an authorized Jigsaw Security Insurance Partner and is not underwritten by Jigsaw Security. For insurance information please contact our JPM program manager. Jigsaw Security operates a network through our NCBroadband brand.