Huntress Says Weak RDP Credentials Enabled Access to QA Environment
Summary
Huntress reported an unknown actor brute-forced an orphaned Windows QA VM using weak RDP credentials. The company said its investigation found no access to customer data or production systems and that it rebuilt the environment with security changes.
Key points
- Huntress said AWS alerted it after a QA instance scanned the internet for open RDP ports.
- The company found 37 orphaned Windows VMs that had remained active after an automated provisioning failure.
- Huntress attributed access to brute-forcing the RDP-enabled test host with the credentials Administrator/abc123!!!.
- The company said its review found no customer data, production systems, source code, or build-pipeline assets accessed or compromised, and no lateral movement.
- Huntress terminated long-running VMs, reviewed AWS and CircleCI logs and production activity, and rotated CircleCI and GitHub API keys.
- The rebuilt QA environment uses per-test SSH keys, disabled RDP, automated termination of long-running VMs, private-subnet access controls, and tighter AWS roles.
Article Details
- Victim Organization
- Huntress
- Incident Type
- Unauthorized access to a QA Windows test VM through brute-forced RDP credentials; the compromised VM scanned public IP addresses for open RDP ports.
- Disclosure Date
- 2021-11-17
- Affected Records
- 0 customer records reported; Huntress stated that no customer data was accessed or compromised.
- Operational Impact
- An unauthorized actor accessed a QA test VM, which was observed scanning public IP addresses. Huntress reported no access to production systems, customer data, billing information, source code, or build pipeline assets. The company terminated long-running QA VMs, rebuilt the QA environment, and changed its security controls.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe actor gained access to the Windows test VM through exposed RDP.T1046 · Network Service DiscoveryThe accessed VM was observed scanning public IP addresses for open RDP ports.T1110.001 · Password GuessingHuntress reported that an unknown actor brute-forced the QA VM's weak Administrator credentials.
Vendors
Amazon Web ServicesOur quality assurance environment is a purposely segmented AWS network that is isolated away from our production systems with separate accounts and user credentials. The environment is used for exercising functionalityCircleCIdebugging and one-way communication with a separate temporary internal Docker container used by CircleCI (our automated build system and continuous integration/continuous deployment pipeline).
Products
Huntress agentaccounts and user credentials. The environment is used for exercising functionality within the Huntress agent. This environment has no customer data and the segmentation prevents access to the production systemsMicrosoft WindowsWe’ve corrected the misconfiguration and the weak authentication mechanism that allowed an ephemeral Windows test host to be brute-forced via RDP 😒