In early 2024, Change Healthcare — one of the largest health payment processors in the United States — was brought to its knees by the ALPHV/BlackCat ransomware group. The initial entry point? A Citrix remote access portal without multi-factor authentication. That single vulnerability led to the exfiltration of data affecting roughly 100 million individuals and a reported $22 million ransom payment. If you think your organization's remote desktop exposure is a minor concern, that number should change your mind.

This post breaks down the remote desktop security risks that threat actors actively exploit in 2026, what makes Remote Desktop Protocol (RDP) such a persistent target, and the specific steps you can take to lock things down before someone else does it for you.

Why Remote Desktop Protocol Is an Attacker's Favorite Door

RDP has been a go-to attack surface for years, and it's not slowing down. The Verizon 2024 Data Breach Investigations Report found that stolen credentials remain the top initial access vector in breaches, and RDP is one of the most common places those credentials get used.

Here's what makes RDP so attractive to attackers. It runs on a well-known port (TCP 3389). It's often exposed directly to the internet. And in too many environments, it's protected by nothing more than a username and password. Automated scanners sweep the entire IPv4 address space looking for open RDP ports, and when they find one, brute-force attacks begin within minutes.

I've seen organizations that didn't even know they had RDP open to the internet. A misconfigured firewall rule, a forgotten test server, a cloud instance with default security groups — any of these can leave port 3389 wide open without anyone on the IT team realizing it.

The 5 Remote Desktop Security Risks You Can't Ignore

1. Brute-Force and Credential Stuffing Attacks

Attackers use automated tools to try thousands of username-password combinations per hour against exposed RDP endpoints. If your organization doesn't enforce account lockout policies or use multi-factor authentication, it's only a matter of time before someone gets in. Credential stuffing — using username/password pairs from previous data breaches — makes this even easier when employees reuse passwords.

2. BlueKeep and Unpatched Vulnerabilities

CVE-2019-0708, known as BlueKeep, was a wormable RDP vulnerability that could allow remote code execution without authentication. Microsoft patched it, but CISA's alert on BlueKeep highlighted just how many systems remained unpatched months later. Newer RDP-related vulnerabilities continue to surface. If your patching cadence is measured in months instead of days, you're carrying unnecessary risk.

3. Man-in-the-Middle Attacks

When RDP sessions aren't properly secured with Network Level Authentication (NLA) and valid TLS certificates, attackers on the same network can intercept sessions. They can capture credentials, inject commands, or hijack the session entirely. This is especially dangerous on flat networks without segmentation.

4. Lateral Movement After Initial Access

Once a threat actor gains access through one RDP endpoint, they rarely stop there. They use tools like Mimikatz to dump credentials from memory, then RDP into other systems across your internal network. This lateral movement is how a single compromised workstation turns into a full-blown ransomware event affecting every server in your environment.

5. Ransomware Deployment

RDP is consistently cited as one of the top three initial access vectors for ransomware attacks. Groups like LockBit, Conti, and ALPHV have all used exposed RDP as an entry point. Once inside, they disable security tools, exfiltrate data, and encrypt systems — often within hours.

What Does an RDP Attack Actually Look Like?

This is a question I get asked often, so here's a straightforward answer designed to help you recognize the threat.

An RDP attack typically follows this pattern: An attacker scans the internet for open port 3389. They launch a brute-force or credential stuffing attack against the login screen. Once they gain access — often using a local administrator account — they disable antivirus, create new user accounts for persistence, move laterally across the network using stolen credentials, and ultimately deploy ransomware or exfiltrate sensitive data. The entire kill chain can happen in under 24 hours.

How to Reduce Your Remote Desktop Attack Surface

Stop Exposing RDP Directly to the Internet

This is the single most impactful step. If you have RDP accessible from the internet, put it behind a VPN or a zero trust network access (ZTNA) solution immediately. Shodan and Censys searches will tell you exactly what attackers already know about your exposed services. Run those searches against your own IP ranges before someone else does.

Enforce Multi-Factor Authentication on Every Remote Session

Passwords alone are not enough. MFA should be mandatory for every remote access method, including RDP. This one control would have prevented the Change Healthcare breach. If your remote desktop gateway doesn't support MFA natively, use a third-party integration or switch to a solution that does.

Implement Network Level Authentication

NLA requires users to authenticate before the full RDP session is established. This reduces the attack surface by preventing unauthenticated users from even reaching the login screen. It also mitigates several denial-of-service and man-in-the-middle scenarios.

Patch Aggressively and Consistently

Every month, Microsoft releases security updates that address RDP-related vulnerabilities. Your patch management process needs to prioritize internet-facing systems and remote access infrastructure. CISA maintains a Known Exploited Vulnerabilities Catalog that should be part of your patching priority framework.

Use Account Lockout and Rate Limiting

Configure account lockout policies to slow down brute-force attacks. Lock accounts after five failed attempts for at least 30 minutes. Combine this with monitoring for failed login patterns — a sudden spike in failed RDP logins from a single IP is an obvious indicator of compromise.

Segment Your Network

A zero trust architecture assumes breach and limits blast radius. Even if an attacker compromises one RDP endpoint, network segmentation prevents them from reaching critical assets like domain controllers, file servers, and backup infrastructure. Micro-segmentation is worth the investment.

Your People Are Part of the Problem — and the Solution

Technical controls matter, but social engineering remains the key enabler for most credential theft. An employee who clicks a phishing link and enters their VPN or RDP credentials on a spoofed login page hands the attacker the keys without any brute-forcing required.

This is why security awareness training isn't optional — it's a critical layer of defense. I've watched organizations cut their phishing click rates by more than half after implementing consistent, scenario-based training. If you haven't started, our cybersecurity awareness training program covers the fundamentals that every employee needs, from credential hygiene to recognizing social engineering tactics.

For organizations that want to go deeper, our phishing awareness training for organizations includes phishing simulation campaigns that test your employees with realistic scenarios — the same kind of lures that lead to RDP credential theft in the real world.

Monitor, Detect, Respond — Don't Just Prevent

Prevention will fail eventually. When it does, you need detection and response capabilities in place. Here's what to monitor for RDP-specific threats:

  • Event ID 4625 — Failed logon attempts. Look for high-volume failures from single source IPs.
  • Event ID 4624 (Type 10) — Successful RDP logons. Correlate with expected user locations and times.
  • New local admin account creation — A classic post-exploitation move after RDP compromise.
  • Unusual outbound data transfers — Exfiltration often precedes ransomware deployment.
  • Disabled antivirus services — Threat actors routinely kill security tools after gaining RDP access.

Feed these events into a SIEM or managed detection and response platform. Automated alerting on these indicators can be the difference between a contained incident and a catastrophic breach.

The Bottom Line on Remote Desktop Security Risks

Remote desktop security risks aren't theoretical. They're actively exploited every day by ransomware operators, initial access brokers selling RDP credentials on dark web marketplaces, and state-sponsored threat actors conducting espionage. The tools and techniques to defend against these attacks exist right now. The question is whether your organization will implement them before or after an incident.

Start by auditing your external attack surface for exposed RDP. Enforce MFA everywhere. Patch your systems. Train your people. These aren't aspirational goals — they're the baseline. Everything else is risk you've chosen to accept.