From Foothold to Full Compromise: Anatomy of a Modern RDP-Fueled Ransomware Campaign

Ransomware headlines tend to focus on the moment the damage becomes visible: encrypted drives, ransom notes plastered across workstations, operations grinding to a halt. What those headlines rarely capture is the quiet, deliberate work that preceded the detonation — sometimes by weeks. For a significant share of enterprise ransomware incidents, that preparatory work begins with a single compromised Remote Desktop Protocol session.

Understanding the architecture of these attacks — how threat actors move from an initial RDP foothold to full domain compromise — is no longer an academic exercise. It is operational necessity.

The Entry Point: Why RDP Remains the Preferred Beachhead

RDP's prevalence in enterprise environments makes it an enduringly attractive target. Exposed port 3389, weak or reused credentials, and the absence of multi-factor authentication create conditions that adversaries actively scan for and exploit at scale. Credential markets on underground forums routinely list RDP access to US-based corporate networks for as little as a few hundred dollars — a modest investment relative to the potential ransomware payout.

Once an attacker authenticates via RDP, they arrive inside the network perimeter with the permissions of the compromised account. There is no exploit to trigger, no payload to deliver at this stage. The session looks, to many monitoring systems, indistinguishable from legitimate administrative activity. That ambiguity is precisely what makes the initial phase so dangerous.

Phase One: Reconnaissance Without Raising Alarms

Following successful authentication, sophisticated threat actors do not move immediately. Instead, they spend time — sometimes days — conducting low-noise reconnaissance. Tools like net user, whoami /all, and nltest are native Windows utilities that blend into normal administrative behavior. Adversaries use them to map the Active Directory structure, identify privileged accounts, locate domain controllers, and assess what backup and security software is present.

This phase also involves evaluating endpoint detection capabilities. Attackers will check for the presence of endpoint detection and response (EDR) agents and, in some cases, identify which version is running to determine whether known evasion techniques apply. The goal is to understand the environment thoroughly before committing to any action that might generate an alert.

Phase Two: Privilege Escalation and Credential Harvesting

With reconnaissance complete, the focus shifts to acquiring elevated credentials. If the initial RDP session was established with a standard user account, attackers will attempt to escalate privileges through a variety of means: exploiting unpatched local vulnerabilities, abusing misconfigured services, or using tools like Mimikatz to extract credentials from memory.

Domain administrator credentials are the primary objective. Once obtained, they dramatically expand the attacker's reach. From a single compromised endpoint, an actor holding domain admin credentials can authenticate to virtually any system in the environment — again, frequently via RDP, which is enabled by default on most Windows Server installations.

This is the phase where the attack shifts from opportunistic to surgical.

Phase Three: Lateral Movement and Staging

Lateral movement in RDP-anchored ransomware campaigns is often methodical rather than explosive. Attackers use their elevated credentials to hop between systems, identifying file servers, backup infrastructure, and domain controllers. Remote administration tools — both legitimate and purpose-built — facilitate this movement. PsExec, WMI, and scheduled tasks are commonly observed in incident forensics during this phase.

Simultaneously, adversaries begin staging their ransomware payload on systems they intend to encrypt. They may disable or tamper with backup agents to ensure that recovery options are limited before the encryption begins. Shadow copy deletion via vssadmin is a near-universal step observed in modern ransomware incidents, and it typically occurs in the hours immediately preceding deployment.

Organizations that monitor for this specific command — particularly when executed in rapid succession across multiple hosts — have an actionable detection opportunity that many fail to operationalize.

Phase Four: Ransomware Deployment

Detonation is typically timed for maximum disruption. Threat actors frequently trigger their ransomware during off-hours — late Friday evenings and holiday weekends are disproportionately represented in incident timelines. The rationale is straightforward: a smaller on-call team, slower response times, and more hours of uncontested encryption before anyone intervenes.

Modern ransomware families are designed to encrypt files rapidly across network shares and local drives simultaneously. Some variants also exfiltrate data prior to encryption, enabling double-extortion tactics where the threat of publishing sensitive data supplements the ransom demand. This exfiltration often occurs through the same RDP infrastructure or via legitimate cloud storage services to avoid triggering egress alerts.

Where the Chain Can Be Interrupted

Every phase described above presents detection and disruption opportunities. The challenge is that most organizations lack the visibility or the operational processes to capitalize on them in time.

At the entry point, enforcing multi-factor authentication on all RDP sessions eliminates the value of stolen credentials alone. Restricting RDP access to specific IP ranges or routing it exclusively through a VPN or zero-trust network access gateway dramatically reduces the exposed attack surface.

During reconnaissance, behavioral analytics that flag unusual use of native Windows enumeration commands — particularly from accounts that do not routinely perform such queries — can surface early-stage intrusions before privilege escalation occurs.

During lateral movement, network segmentation ensures that a compromised endpoint in one segment cannot freely authenticate to systems in another. Privileged access workstations and just-in-time administrative access models further constrain an attacker's ability to propagate domain credentials across the environment.

At the staging phase, monitoring for shadow copy deletion, mass file access anomalies, and the deployment of new scheduled tasks across multiple hosts simultaneously provides a detection window that, if acted upon within minutes, can prevent full encryption.

The Forensic Value of RDP Logs

Post-incident investigations consistently demonstrate that RDP logs — when properly preserved and centralized — contain the full story of an intrusion. Authentication events, session durations, source IP addresses, and process execution history tied to remote sessions can reconstruct the attacker's timeline with considerable precision.

The problem is that default Windows logging configurations are rarely sufficient for this purpose. Security Event IDs 4624, 4648, and 4778 capture authentication activity, but without enhanced audit policies and centralized log aggregation, they may be overwritten or simply never forwarded to a SIEM before they are needed.

Organizations that invest in robust RDP telemetry before an incident occurs are meaningfully better positioned to contain damage, satisfy regulatory notification requirements, and prevent recurrence.

Rethinking RDP as a Risk Surface

The persistence of RDP as a ransomware entry vector is not a technology failure — it is a governance failure. The protocol itself is capable of operating securely when properly configured, monitored, and access-controlled. The gap lies in the frequency with which organizations treat RDP as a convenience rather than a critical security boundary.

For IT and security leaders, the imperative is to evaluate every RDP-accessible system with the same scrutiny applied to internet-facing applications. That means mandatory MFA, network-level authentication, session logging, and integration with threat detection platforms that can identify behavioral anomalies in real time.

The ransomware pipeline that attackers have refined over the past several years is not particularly complex. It is, however, highly effective against environments that have not closed the foundational gaps that make it possible. Closing those gaps — methodically and completely — remains the most reliable way to ensure that an RDP session never becomes the first link in a chain that ends in catastrophe.