Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Sophos found that attackers abused Remote Desktop Protocol (RDP) in 90% of more than 150 incident-response cases its X-Ops team handled in 2023. That is a statistic about Sophos’s investigated cases—not a measurement of all cyberattacks worldwide—and the company reported 90%, not “over 90%.”
What Sophos’s 90% figure means
Sophos’s April 2024 release reported that RDP was abused in 90% of more than 150 cases investigated by Sophos X-Ops in 2023. Sophos described this as the highest incidence in its Active Adversary reporting since it began publishing reports based on 2020 data. The percentage applies to the cases Sophos handled; it should not be read as the share of attacks across the internet or all organizations. Sophos’s 2023 findings
The same release said external remote services, such as RDP, were the initial access method in 65% of those cases. That figure covers external remote services as a category, not RDP alone. It is distinct from the 90% figure, which concerns RDP abuse across the investigated attacks.
How the 2024 figures differ
Sophos’s first-half 2024 report separates RDP’s role in attacks into two categories. It found RDP was used for internal lateral movement in 90% of attacks and for external remote access in 20%. These are different uses of the protocol and must not be combined into a single rate. Sophos Active Adversary report
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
In a later release covering the first half of 2024, Sophos said RDP was abused in 89% of nearly 200 incident-response and managed-detection-and-response cases. That sample and timeframe differ from the more than 150 X-Ops incident-response cases from 2023. Sophos’s first-half 2024 findings
| Finding | What it measures | Scope |
|---|---|---|
| 90% involved RDP abuse | RDP abuse in investigated attacks | More than 150 Sophos X-Ops incident-response cases in 2023; reported by Sophos in April 2024 |
| 65 used external remote services for initial access | External remote services, including RDP—not RDP alone | Sophos’s 2023 incident-response cases |
| 90% used RDP for internal lateral movement | Movement within a network after access | Sophos 1H 2024 Active Adversary report |
| 20% used RDP for external remote access | Remote access from outside | Sophos 1H 2024 Active Adversary report |
| 89% involved RDP abuse | RDP abuse in investigated cases | Nearly 200 Sophos IR/MDR cases in the first half of 2024 |
Why attackers use RDP
RDP is a standard Windows technology for remotely accessing and controlling a computer. Its legitimate role makes it useful in organizations, but it also gives attackers a familiar way to access systems or move between them after getting inside a network. Internet-exposed or poorly secured remote services can create an initial entry point; RDP already available inside the network can support lateral movement. Sophos’s findings show how often its investigators encountered that abuse, not that RDP itself caused every incident.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
How to reduce RDP risk
CISA recommends disabling RDP when it is not needed. Where remote desktop access is operationally necessary, CISA advises putting it behind a secure VPN with multifactor authentication (MFA) or a zero-trust remote-access gateway, and limiting access to approved security groups. RDP commonly communicates over TCP port 3389. CISA RDP countermeasures
CISA’s ransomware guidance also advises organizations not to expose RDP services directly to the web. For systems that need RDP, it recommends auditing their use, closing unused RDP ports, enforcing account lockouts, applying MFA and logging login attempts. CISA ransomware guide
Quick Recap
Best Value
Rank #4
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11"
- Reorder SKU: LOG-100-7CW-PP(Watch-Log)
- Inventory RDP use. Identify which computers and servers have RDP enabled, why each needs it and who owns that business need.
- Remove unnecessary access. Disable RDP on systems without an operational requirement and close unused access paths and ports.
- Broker necessary connections. Keep RDP off the public internet; use a VPN protected by MFA or a zero-trust gateway, and restrict which users and source networks can connect.
- Strengthen and monitor authentication. Enforce MFA and account lockouts, and log RDP login attempts and session activity.
- Investigate anomalies. Review unusual logins, source locations, access times or activity that does not match expected work patterns.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
