Threat reportThreat IntelligenceTL-2026-0775
Exposed RDP / RDWeb Misconfigurations Exploited for Initial Access and Lateral Movement (Huntress 2026)
Exposed RDP / RDWeb Misconfigurations Exploited for Initial (TL-2026-0775) is a high-severity tracked intrusion set, first published 2026-06-11. It has no confirmed attribution, affects Microsoft Windows Remote Desktop Protocol (RDP) / Terminal Services, maps to 17 MITRE ATT&CK techniques (T1003, T1018, T1021.001), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-0775
- Threat ID
- TL-2026-0775
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- healthcare, small and medium business, managed service providers
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Exposed RDP / RDWeb Misconfigurations Exploited for Initial
Malware and tooling: Advanced IP Scanner, Custom Windows/Linux reverse tunnel, Shodan
How Exposed RDP / RDWeb Misconfigurations Exploited for Initial works
Huntress SOC documented three real-world 2026 intrusions where threat actors abused internet-exposed RDP (TCP 3389), RDWeb portals, and a vulnerable SonicWall VPN as initial access vectors. After entry, actors enumerated networks with Advanced IP Scanner, ran credential-harvesting scripts, deployed a custom Windows/Linux reverse tunnel hosted on cheap Hostinger and Freakhosting infrastructure, and modified registry and firewall settings to (re)enable RDP for lateral movement and persistence. No CVE or exploit was required — exposure and misconfiguration alone enabled the intrusions.
In May 2026 Huntress published an analysis of recurring real-world incidents in which adversaries gained initial access to victim networks purely through exposed and misconfigured remote-access surfaces, with no software vulnerability required in most cases. Across three documented intrusions, the entry points were (1) an internet-exposed Remote Desktop Protocol (RDP) service listening on TCP 3389 at a healthcare organization, (2) an exposed Remote Desktop Web Access (RDWeb) portal, and (3) a vulnerable SonicWall VPN appliance.
The operators located targets using internet-wide scanning of port 3389 (e.g., Shodan-style active scanning of IP blocks and vulnerability scanning), then authenticated using valid credentials — obtained via credential stuffing, brute force, or prior theft. In the RDWeb incident, after the Huntress SOC ejected the attacker, the actor returned the following morning through the same portal using a different account because the exposure had not been remediated, illustrating how the open surface itself — not any single account — is the durable weakness.
Post-compromise, the actors performed network discovery with Advanced IP Scanner, mapped reachable hosts and services, and used valid accounts to move laterally over RDP (T1021.001). They executed automated credential-harvesting scripts to expand access. To maintain command and control they deployed a custom-built reverse tunnel with both Windows and Linux builds, staged on low-cost hosting providers Hostinger and Freakhosting, providing protocol tunneling back to attacker infrastructure.
In the SonicWall-VPN intrusion the attacker, once inside, deliberately re-enabled and reopened RDP by issuing Windows command-shell commands: setting the registry value HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections to 0 (reg add ... /d 0 /f), adding an inbound Windows Firewall allow rule for TCP 3389 (netsh advfirewall firewall add rule name="RDP-Open" dir=in protocol=TCP localport=3389 action=allow), and restarting the Terminal Services service (net stop TermService / net start TermService). These changes disable the host firewall protection for RDP, modify the registry to permit Terminal Services connections, and (re)start the RDP service — combining defense evasion, persistence, and lateral-movement enablement.
The campaign is notable not for sophistication but for reliability: in 2026 exposed RDP and adjacent remote-access surfaces remain one of the most dependable initial-access vectors. The defensive value of this record is concrete hardening and detection guidance — removing internet exposure of RDP/RDWeb, patching VPN appliances, monitoring firewall/VPN logs in a SIEM alongside endpoint telemetry, and alerting on the specific registry/firewall/service commands actors use to reopen RDP.
MITRE ATT&CK techniques used in TL-2026-0775
Credential Access
T1003 OS Credential Dumping; T1110 Brute Force
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol
Execution
T1059.003 Windows Command Shell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
defense-impairment
T1112 Modify Registry; T1686 Disable or Modify System Firewall
Persistence
T1133 External Remote Services
Reconnaissance
T1595.001 Scanning IP Blocks; T1595.002 Vulnerability Scanning
Affected products and versions in Exposed RDP / RDWeb Misconfigurations Exploited for Initial
- Microsoft — Windows Remote Desktop Protocol (RDP) / Terminal Services
Vulnerable versions: Internet-exposed RDP on TCP 3389 (any version)
Fixed in: N/A - misconfiguration, not a software flaw - Microsoft — Remote Desktop Web Access (RDWeb)
Vulnerable versions: Internet-exposed RDWeb portal
Fixed in: N/A - misconfiguration / exposure - SonicWall — SonicWall VPN appliance
Vulnerable versions: Unpatched / vulnerable SonicWall VPN
Fixed in: Current SonicWall firmware
Remediation for Exposed RDP / RDWeb Misconfigurations Exploited for Initial
Patches
- Apply current SonicWall VPN appliance firmware updates
Immediate actions
- Remove RDP (TCP 3389) and RDWeb portals from direct internet exposure; place behind a VPN or firewall and require MFA
- Block the offending source IP addresses at the perimeter
- Disable the RDP service on hosts where it is not required and reverse any attacker-made registry changes (restore fDenyTSConnections to 1)
- Confirm Windows Firewall rules have not been altered; remove any unauthorized 'RDP-Open'-style inbound allow rule on port 3389
- Reset all affected and potentially harvested credentials and terminate active sessions
Workarounds
- Restrict RDP source IPs via firewall allowlists
- Use an RD Gateway with MFA instead of exposing 3389 directly
- Disable RDWeb where unused
Longer-term hardening
- Patch and update SonicWall VPN and all internet-facing remote-access appliances to current firmware
- Enforce MFA on all remote-access surfaces (RDP gateway, RDWeb, VPN)
- Integrate firewall and VPN logs into a SIEM alongside EDR/endpoint telemetry for unified visibility
- Deploy EDR with behavioral detection for credential harvesting and tunneling tools
- Periodically scan your own external footprint (e.g., Shodan) for exposed 3389/RDWeb
- Apply network segmentation and account lockout / brute-force throttling on remote-access auth
Weaknesses (CWE) in Exposed RDP / RDWeb Misconfigurations Exploited for Initial
Timeline of Exposed RDP / RDWeb Misconfigurations Exploited for Initial
- Huntress SOC observes intrusion at a healthcare organization via an internet-exposed RDP service on TCP 3389.
- Attacker gains access through an exposed RDWeb portal, deploys a custom reverse tunnel and automated credential-harvesting scripts; Huntress SOC ejects the attacker.
- Attacker returns the next morning through the same RDWeb portal using a different account because the exposure was not remediated.
- Attacker enumerates the network with Advanced IP Scanner and moves laterally over RDP using valid accounts.
- Post-compromise, attacker modifies registry (fDenyTSConnections=0), adds a firewall allow rule for TCP 3389, and restarts Terminal Services to (re)enable RDP for lateral movement.
- Attacker compromises a partner network via a vulnerable SonicWall VPN, using Hostinger and Freakhosting infrastructure as a launchpad.
- Huntress publishes the 'Exposed RDP: The Misconfiguration Attackers Keep Exploiting' analysis documenting the three incidents.
- CyberSecurityNews, SOC Prime, and CyberPress report on the Huntress findings; Jamaica CIRT issues a corroborating advisory.
Sources cited for Exposed RDP / RDWeb Misconfigurations Exploited for Initial
- Exposed RDP: The Misconfiguration Attackers Keep Exploiting
- Attackers Abuse Open RDP Ports to Gain Initial Access Into Business Networks
- Exposed RDP: The Misconfiguration That Still Pays Off for Attackers
- Exposed Remote Desktop Protocol (RDP) Services Continue to Enable Unauthorized Network Intrusions
- Open RDP Services Abused by Hackers For Initial Network Access
- MITRE ATT&CK T1021.001 - Remote Services: Remote Desktop Protocol
- MITRE ATT&CK T1572 - Protocol Tunneling
Detection coverage for TL-2026-0775
As of 2026-06-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0775 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.