---
title: The FBI Warns of a New Cyber Security Threat
description: The FBI and the US Department of Homeland Security issued a joint statement about the increasing risks of Remote Desktop Protocol (RDP) attacks.
image: https://blog.grantmcgregor.co.uk/hubfs/RDP.png
---
[](https://www.grantmcgregor.co.uk/)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
- [Home](https://grantmcgregor.co.uk/)
- About Us
- [Our Story](https://grantmcgregor.co.uk/about-us/our-story)
- [Meet the Team](https://grantmcgregor.co.uk/about-us/meet-the-team)
- [Certifications](https://grantmcgregor.co.uk/about-us/certifications)
- [Careers](https://grantmcgregor.co.uk/about-us/careers)
- IT Support Services
- [IT Support Services](https://grantmcgregor.co.uk/it-support-services)
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
- Professional IT Services
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Microsoft 365](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-business-premium)
- [Microsoft Copilot](https://grantmcgregor.co.uk/professional-it-services/microsoft-365-copilot)
- [AI Adoption Services](https://grantmcgregor.co.uk/ai-adoption-services)
- [Microsoft Azure](https://grantmcgregor.co.uk/professional-it-services/microsoft-azure)
- [MDR](https://blog.grantmcgregor.co.uk/mdr-vs-soc-cyber-security-defence)
- [Microsoft Teams Phone](https://grantmcgregor.co.uk/professional-it-services/microsoft-teams-phone)
- [KnowBe4](https://grantmcgregor.co.uk/professional-it-services/knowbe4)
- [DMARC](https://grantmcgregor.co.uk/professional-it-services/dmarc)
- [Enclave Networks](https://grantmcgregor.co.uk/professional-it-services/enclave-networks)
- Knowledge Hub
- [Case Studies](https://grantmcgregor.co.uk/knowledge-hub/case-studies)
- [Testimonials](https://grantmcgregor.co.uk/knowledge-hub/success-stories)
- [Blog](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Podcast](https://grantmcgregor.co.uk/knowledge-hub/podcast)
- [Client Area](https://grantmcgregor.co.uk/client-area)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
[Contact Us](https://grantmcgregor.co.uk/contact-us)
[Back to main](https://grantmcgregor.co.uk/knowledge-hub/blog)
Business News, Digital Transformation, Cyber Security
# The FBI Warns of a New Cyber Security Threat
Grant McGregor Team
29 October 2018 • 5 min read
# Most cyber security news recently has focused on the revelation of Russian military intelligence service attacks, but there has been a recent announcement about cyber security practice to which organisations of all sizes including small businesses should be paying much greater attention.
On September 28th, the FBI and the US Department of Homeland Security issued a joint statement about the increasing risks of Remote Desktop Protocol (RDP) attacks. According to the two US agencies, the use of RDP as an attack vector or way into your systems has been steadily on the increase. They are warning individuals and organisations to put measures in place to protect themselves against this type of attack.
While [the Register](https://www.theregister.co.uk/2018/09/28/fbi_dhs_rdp/) might have dismissed the advice as “The bleedin' obvious”, attacks of this kind have been on the increase since 2016. The FBI and USDHS cited a brute force attack - SamSam - on RDP credentials against a healthcare company earlier this year which left thousands of its machines encrypted before the attack was detected. The risks are real – and businesses would be well advised to take the necessary precautions.
Grant McGregor answers a few key questions, so you can find out everything you need to know about RDP attacks.
### What is RDP?
Microsoft's Remote Desktop Protocol (RDP) allows you to connect to remote Windows based desktops or applications running on a Windows Server. To do this, the user employs RDP client software, while the other computer must run RDP server software.
### How do attackers launch RDP attacks?
The [University of California at Berkeley](https://security.berkeley.edu/resources/best-practices-how-articles/system-application-security/securing-remote-desktop-rdp-system) points out that if “any time Administrator access to a system is granted remotely there are risks”. These risks are greater if you are using weak passwords or outdated versions of RDP that allow so-called 'man-in-the-middle' attacks.
The number of malware instances which support RDP attacks is mushrooming. They include SamSam - as mentioned previously, CrySiS, a ransomware that targets businesses through open RDP ports, and CryptON, which uses brute force attacks to gain access to RDP sessions.
There is also a thriving market for cyber criminals buying and selling RDP login credentials over the dark web.
### What is at risk through RDP attacks?
Attackers exploit vulnerable RDP sessions over the Internet. These types of attacks allow cyber attackers to gain unrestricted access to the default RDP port (3389). They can then steal login credentials, compromise identities, and steal or ransom data.
### Why are RDP attacks growing in number?
As well as the growing number of exploits available for hackers to use on RDP vulnerabilities, RDP exploits are popular with attackers because intrusions are more difficult to detect. An attacker can control a computer over the Internet without requiring user input.
### How can businesses protect themselves?
Security controls are vital to protect your business against RDP attacks. This includes ensuring that RDP versions are up to date and [using strong passwords](https://www.grantmcgregor.co.uk/2018/best-practice-password-security/).
Wherever possible, disable the service if it is not needed. If the service is required, install all available patches regularly and enable account lockout policies.
As a quick checklist, Grant McGregor recommends:
• Minimise use – restrict access to and use of RDP where possible (for users and critical devices)
• Make it harder to access – with strong passwords and, better still, two-factor authentication
• Maintain updates or patching – to both systems and software
• Monitor activity – to ensure attackers aren’t targeting your business
• Minimise network exposure – so if attackers do get in, the damage they can wreak is limited
• Make good backups – a regular and proven backup strategy will facilitate recovery from data loss or unwanted encryption
### What should businesses be monitoring with regards to RDP attacks?
You should be monitoring for brute-force activity in general, and this will be an important part of protecting yourself against RDP attacks, specifically against RDP port 3389. Experienced administrators may wish to change the port used for RDP as an extra layer of protection.
### What extra protection do I need to take if I use cloud services?
The process for securing your virtual machines against RDP attacks is similar to the process of securing your physical machines. We recommend ensuring your virtual machines do not have open RDP ports, unless there is a compelling business reason. If you need open RDP ports, seek advice from your cloud provider about the best way to secure them.
### What should I do if I suspect I have been victim of an RDP attack?
If your data or machines have been compromised, you may well need to revert to backups to restore services. If necessary, reach out to Grant McGregor for additional support and professional help to restore systems and services.
If data has been compromised, under GDPR you have a responsibility to report the fact to the [Information Commissioner’s office](https://ico.org.uk/). Do this swiftly so you don’t leave yourself open to later problems. The ICO can also offer helpful advice about how to protect your business data.
Unfortunately, the FBI and USDHS have left [the onus very much on individuals](https://searchsecurity.techtarget.com/blog/Security-Bytes/FBI-DHS-blaming-the-victims-on-Remote-Desktop-Protocol) and businesses to protect their own data, so if you need help securing RDP clients and ports within your organisation, please reach out for assistance from the Grant McGregor security team.
If you would like more information about how to secure your organisation against RDP attacks, contact the Grant McGregor security team on 0808 164 4142.
Photo by [Pakata Goh](https://unsplash.com/photos/EJMTKCZ00I0?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) on [Unsplash](https://unsplash.com/search/photos/rdp?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)
Grant McGregor Team
29 October 2018 • 5 min read
## Recent Posts
### Cyber Security Awareness Month: Why Attackers Still Target the Basics
Learn key cyber security practices for your organisation during Cyber Security Awareness Month. Protect against basic vu...
[Read More](https://blog.grantmcgregor.co.uk/cyber-security-awareness-month)
### Shadow AI: Is Your Business Ready for AI Adoption?
Understand shadow AI's impact on your business. Discover how to assess risks, improve processes, and adopt AI securely w...
[Read More](https://blog.grantmcgregor.co.uk/shadow-ai-is-your-business-ready-for-ai-adoption)
### Our Net Zero Target for 2040: What Can We Change?
From company vehicles and travel to suppliers and technology, see how Grant McGregor is working towards its net zero tar...
[Read More](https://blog.grantmcgregor.co.uk/our-net-zero-target-for-2040-what-can-we-change)
### What Is Penetration Testing? A Guide for Businesses
Learn what penetration testing is, how it works, what the report should include and when your business should consider a...
[Read More](https://blog.grantmcgregor.co.uk/what-is-penetration-testing-a-guide-for-businesses)
Union
## Empower your business with secure, expert-led solutions.
Talk to us about people-focused technology that drives results.
[Start a conversation](https://grantmcgregor.co.uk/contact-us)
Premium IT Services Tailored for Leading Brands
[Follow us on LinkedIn](https://www.linkedin.com/company/grant-mcgregor-ltd/) [Follow us on Facebook](https://www.youtube.com/itgrantmcgregor) [Follow us on Facebook](https://www.facebook.com/grantmcgregorltd/) [Follow us on Twitter](https://x.com/GrantMcGregorIT)
Quick Links
- [Home](https://grantmcgregor.co.uk)
- [About us](https://grantmcgregor.co.uk/about-us/our-story)
- [Knowledge Hub](https://grantmcgregor.co.uk/knowledge-hub/blog)
- [Contact us](https://grantmcgregor.co.uk/contact-us)
Services
- [People Centric Support](https://grantmcgregor.co.uk/it-support-services/people-centric-support)
- [Enhanced Security Service](https://grantmcgregor.co.uk/it-support-services/enhanced-security-service)
- [Professional IT Services](https://grantmcgregor.co.uk/professional-it-services)
- [Cyber Security](https://grantmcgregor.co.uk/cyber-security)
Edinburgh – Chesterfield
[0131 603 7910](tel:+441316037910)
[info@grantmcgregor.co.uk](mailto:info@grantmcgregor.co.uk)
**Main Office:**
The Merchants' Hall,
22 Hanover St,
Edinburgh EH2 2EP
© 2026
Grant McGregor. All rights reserved.
[Privacy and Cookie Policy](https://blog.grantmcgregor.co.uk/hubfs/UsefulDownloads/Policies/GRMC-SEC-Privacy-and-Cookie-Policy.pdf)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Grant McGregor Team",
"url" : "https://blog.grantmcgregor.co.uk/author/grmc-team"
},
"dateModified" : "2020-10-28T10:38:25.151Z",
"datePublished" : "2018-10-29T15:33:58.000Z",
"headline" : "The FBI Warns of a New Cyber Security Threat",
"image" : [ "https://blog.grantmcgregor.co.uk/hubfs/RDP.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.grantmcgregor.co.uk/2018/the-fbi-warns-of-a-new-cyber-security-threat",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg"
},
"name" : "Grant McGregor"
}
}
```
```json
{
"@context" : "https://schema.org",
"@id" : "https://grantmcgregor.co.uk/",
"@type" : "LocalBusiness",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "GB",
"addressLocality" : "Edinburgh",
"postalCode" : "EH2 2EP",
"streetAddress" : "22 Hanover Street"
},
"geo" : {
"@type" : "GeoCoordinates",
"latitude" : 55.9526313,
"longitude" : -3.1970679
},
"image" : "https://grantmcgregor.co.uk/hubfs/GRMC_blue_logo.svg",
"name" : "Grant McGregor",
"openingHoursSpecification" : {
"@type" : "OpeningHoursSpecification",
"closes" : "18:00",
"dayOfWeek" : [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ],
"opens" : "08:00"
},
"sameAs" : [ "https://www.facebook.com/grantmcgregorltd/", "https://x.com/GrantMcGregorIT", "https://www.youtube.com/itgrantmcgregor", "https://www.linkedin.com/company/grant-mcgregor-ltd/" ],
"telephone" : "+441316037910",
"url" : "https://grantmcgregor.co.uk/"
}
```