Is port 3389 (RDP) exposed to the internet, and is that a ransomware risk?
Port 3389 is the default port for Microsoft's Remote Desktop Protocol, which gives a remote user an interactive desktop session. RDP itself supports encryption and authentication, but a joint CISA/FBI advisory on initial access techniques names it one of the most common infection vectors for ransomware, specifically because a port forwarded directly to the internet turns its login prompt into a target for credential-stuffing and brute-force attacks at scale.
By AdminKit team, Netbase JSC · Updated October 23, 2026
Why direct RDP exposure is a top ransomware vector
RDP as a protocol supports TLS encryption and authentication, and used inside a trusted network or behind a VPN it’s a normal remote-access tool. The risk is specifically about internet-facing exposure: the joint CISA & FBI advisory AA22-137A on weak security controls routinely exploited for initial access states plainly that RDP is “one of the most common infection vector[s] for ransomware,” alongside Telnet and other services the same advisory names as high-risk to expose directly.
How attackers actually exploit it
Mass internet-scanning tools let an attacker find every IP address with port 3389 open within minutes. From there, automated credential-stuffing (reusing passwords leaked from unrelated breaches) or brute-force attempts run against whatever accounts can be enumerated — often using already-compromised credentials bought from criminal marketplaces rather than guessing blind. A successful login gives an attacker an interactive desktop session with whatever privileges that account holds, commonly used to disable security tooling, harvest more credentials, and move laterally before deploying ransomware on systems worth encrypting.
How to check your own exposure
AdminKit’s planned open ports check is designed to test whether port 3389 on your own public IP responds from outside your network, with your consent and only against the IP making the request. Confirm your current public IP first with what is my IP.
How to fix it
- Put remote desktop access behind a VPN or a zero-trust access broker rather than forwarding port 3389 directly — the login prompt itself should never be reachable from the open internet.
- Require multi-factor authentication on the remote-access layer, which closes the credential-reuse risk even if a password leaks elsewhere.
- If RDP absolutely must be reachable directly, restrict it to specific source IP ranges and enable Network Level Authentication — though a tunnel remains the stronger fix.
See RDP and VNC exposed to the internet for the full comparison with VNC and more on the zero-trust alternative.
Defensive use only
Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.
This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.
Frequently asked questions
Is RDP itself insecure?
No — it supports encryption and authentication and is a normal tool inside a trusted network or behind a VPN. The risk this page addresses is specifically direct internet exposure, which turns its login prompt into a target reachable by anyone, anywhere.
What does a real advisory actually say?
The joint CISA & FBI advisory AA22-137A states that Remote Desktop Protocol is "one of the most common infection vector[s] for ransomware," and groups it with Telnet and other services that shouldn't be exposed directly to the internet.
How do attackers find exposed RDP so quickly?
Mass internet-scanning tools let an attacker find every IP address with port 3389 open within minutes, after which automated credential-stuffing or brute-force attempts run against whatever accounts can be enumerated.
What's the recommended alternative to a direct port forward?
A VPN or zero-trust access broker in front of RDP, with multi-factor authentication on that access layer, so the RDP login prompt itself is never directly reachable from the open internet.
Want AdminKit to watch this for you?
Free checks tell you the state today. Protective DNS and monitoring tell you when it changes.