Huntress Traces RDP Brute Force to Suspected Ransomware Infrastructure

Summary

Huntress traced a successful RDP brute-force intrusion, credential-file searching and domain enumeration to infrastructure it suspects is linked to ransomware operators and initial access brokers.

Key points

Attackers brute-forced an internet-exposed RDP server; one account was successfully compromised after multiple accounts were targeted.
The compromised account logged in from multiple IP addresses, and the intruder enumerated the victim’s domain.
Investigators observed the attacker manually opening text files that appeared to contain credentials, an unusual behavior compared with credential theft from LSASS or the registry.
Huntress isolated the network after identifying malicious domain-enumeration activity, preventing further lateral movement.
TLS certificate pivots linked the brute-force infrastructure to specialsseason[.]com and 1vpns[.]com.
The article cites public reporting associating an IP with Hive ransomware and BlackSuit, and reports linking the VPN service to two ransomware groups; Huntress presents the broader initial-access-broker connection as suspected.

Article Details

Attack Vectors: An internet-exposed RDP server was successfully brute-forced, compromising one account.
After gaining access, the threat actor enumerated the victim's domain, including groups and domain configurations.
The threat actor manually searched files for credentials, opening password-containing text files in Notepad.
Defensive Notes: The SOC isolated the network after identifying malicious domain-enumeration activity to prevent further lateral movement.
Available Windows event-log telemetry helped investigators identify the successful brute-force attack; the article notes that relevant events can be overwritten or discarded in some default logging configurations.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`1vpns[.]com`	Additional domain identified by pivoting on TLS certificates associated with the brute-force infrastructure; identified as malicious.
DOMAIN	`specialsseason[.]com`	Domain found in a TLS certificate associated with an offending brute-force IP address; identified in the article as malicious infrastructure.
IPV4	`147[.]135[.]36[.]162`	Listed as an IOC in the infrastructure associated with the investigation.
IPV4	`64[.]190[.]113[.]159`	Listed as an IOC and associated with the RDP brute-force activity.
SHA1	`65899cd65dd753d2eef5463f120ae023e873e1bd`	TLS certificate fingerprint listed as an IOC for the associated infrastructure.
SHA256	`6bc8b8f260f9f9bfea69863ef8d3c525568676ddadc09c14655191cad1acdb5b`	TLS certificate fingerprint listed as an IOC for the associated infrastructure.
SHA256	`b884cce828f06fb936fd5809d5945d861401c606c4ebe894464c99e6473e9570`	TLS certificate fingerprint listed as an IOC; the source labels its fingerprint type “SHA-246.”