# Exposed RDP / RDWeb Misconfigurations Exploited for Initial Access and Lateral Movement (Huntress 2026)

> Huntress SOC documented three real-world 2026 intrusions where threat actors abused internet-exposed RDP (TCP 3389), RDWeb portals, and a vulnerable SonicWall VPN as initial access vectors. After entry, actors enumerated networks with Advanced IP Scanner, ran credential-harvesting scripts, deployed a custom Windows/Linux reverse tunnel hosted on cheap Hostinger and Freakhosting infrastructure, and modified registry and firewall settings to (re)enable RDP for lateral movement and persistence. No CVE or exploit was required — exposure and misconfiguration alone enabled the intrusions.

- **Published:** 2026-06-11T00:00:00Z
- **Last reviewed:** 2026-06-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0775
- **ID:** TL-2026-0775
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2026 Huntress published an analysis of recurring real-world incidents in which adversaries gained initial access to victim networks purely through exposed and misconfigured remote-access surfaces, with no software vulnerability required in most cases. Across three documented intrusions, the entry points were (1) an internet-exposed Remote Desktop Protocol (RDP) service listening on TCP 3389 at a healthcare organization, (2) an exposed Remote Desktop Web Access (RDWeb) portal, and (3) a vulnerable SonicWall VPN appliance.

The operators located targets using internet-wide scanning of port 3389 (e.g., Shodan-style active scanning of IP blocks and vulnerability scanning), then authenticated using valid credentials — obtained via credential stuffing, brute force, or prior theft. In the RDWeb incident, after the Huntress SOC ejected the attacker, the actor returned the following morning through the same portal using a different account because the exposure had not been remediated, illustrating how the open surface itself — not any single account — is the durable weakness.

Post-compromise, the actors performed network discovery with Advanced IP Scanner, mapped reachable hosts and services, and used valid accounts to move laterally over RDP (T1021.001). They executed automated credential-harvesting scripts to expand access. To maintain command and control they deployed a custom-built reverse tunnel with both Windows and Linux builds, staged on low-cost hosting providers Hostinger and Freakhosting, providing protocol tunneling back to attacker infrastructure.

In the SonicWall-VPN intrusion the attacker, once inside, deliberately re-enabled and reopened RDP by issuing Windows command-shell commands: setting the registry value HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections to 0 (reg add ... /d 0 /f), adding an inbound Windows Firewall allow rule for TCP 3389 (netsh advfirewall firewall add rule name="RDP-Open" dir=in protocol=TCP localport=3389 action=allow), and restarting the Terminal Services service (net stop TermService / net start TermService). These changes disable the host firewall protection for RDP, modify the registry to permit Terminal Services connections, and (re)start the RDP service — combining defense evasion, persistence, and lateral-movement enablement.

The campaign is notable not for sophistication but for reliability: in 2026 exposed RDP and adjacent remote-access surfaces remain one of the most dependable initial-access vectors. The defensive value of this record is concrete hardening and detection guidance — removing internet exposure of RDP/RDWeb, patching VPN appliances, monitoring firewall/VPN logs in a SIEM alongside endpoint telemetry, and alerting on the specific registry/firewall/service commands actors use to reopen RDP.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.003 Windows Command Shell
- T1133 External Remote Services
- T1686 Disable or Modify System Firewall
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1049 System Network Connections Discovery
- T1021.001 Remote Desktop Protocol
- T1572 Protocol Tunneling
- T1090 Proxy
- T1105 Ingress Tool Transfer

## Sources

- [Exposed RDP: The Misconfiguration Attackers Keep Exploiting](https://www.huntress.com/blog/exposed-rdp-misconfiguration-risks)
- [Attackers Abuse Open RDP Ports to Gain Initial Access Into Business Networks](https://cybersecuritynews.com/attackers-abuse-open-rdp-ports/)
- [Exposed RDP: The Misconfiguration That Still Pays Off for Attackers](https://socprime.com/active-threats/exposed-rdp-the-misconfiguration-that-still-pays-off-for-attackers/)
- [Exposed Remote Desktop Protocol (RDP) Services Continue to Enable Unauthorized Network Intrusions](https://www.cirt.gov.jm/advisory/exposed-remote-desktop-protocol-rdp-services-continue-enable-unauthorized-network)
- [Open RDP Services Abused by Hackers For Initial Network Access](https://cyberpress.org/hackers-abuse-open-rdp/)
- [MITRE ATT&CK T1021.001 - Remote Services: Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001/)
- [MITRE ATT&CK T1572 - Protocol Tunneling](https://attack.mitre.org/techniques/T1572/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0775