RDP and VNC exposed to the internet: a leading ransomware entry vector

Why RDP and VNC exposure gets singled out

Remote Desktop Protocol and VNC (Virtual Network Computing) both exist to do the same basic thing: give a remote user a full interactive desktop session on another machine. That’s exactly what makes a directly internet-reachable instance so dangerous — unlike a web application with a narrow attack surface, a working remote-desktop login is effectively “you’re in” the moment an attacker has valid (or valid-enough) credentials. The joint CISA/FBI advisory on weak security controls routinely exploited for initial access states this directly: “with Remote Desktop Protocol (RDP) as one of the most common infection vector[s] for ransomware, MFA is a critical tool in mitigating malicious cyber activity.” The same advisory groups RDP alongside Telnet, SMB, and NetBIOS as protocols it labels explicitly as “high-risk services” that should not be left reachable from the open internet.

How the attack actually unfolds

The path from “RDP port open” to “ransomware deployed” is well documented across dozens of advisories, and it typically runs through a few predictable stages:

1. Discovery. Automated internet-wide scanning tools (the same category of tooling security researchers use defensively) find every IP address with port 3389 or 5900 responding in a matter of minutes — an attacker doesn’t need to target your organization specifically to find your exposed port.
2. Credential attack. Rather than guessing blindly, attackers commonly use credentials leaked from unrelated breaches (credential stuffing), slow password-spraying across many accounts to avoid lockout thresholds, or outright buy working credentials from criminal marketplaces.
3. Initial foothold. A successful login hands the attacker an interactive session with whatever access that account has — often enough to start harvesting more credentials and mapping the network immediately.
4. Lateral movement and escalation. CISA’s advisory notes the risk compounds from there: a single compromised account on a flat network can become a path to file servers, backup systems, and domain controllers.
5. Ransomware deployment, once the attacker has reached systems they judge valuable enough to encrypt and hold for ransom.

Why this is specifically a direct exposure problem

None of this requires a flaw in RDP or VNC’s cryptography — it exploits the fact that the login prompt itself is reachable by anyone on the internet, turning authentication into the only line of defense against an attacker with unlimited attempts and, often, already-leaked passwords to try. An RDP or VNC session reached through an authenticated VPN or access broker has the same functionality without that exposure, because the login prompt is never visible to anyone who hasn’t already proven they belong on the network.

How to check and fix your own exposure

1. Confirm your public IP with AdminKit’s what is my IP tool.
2. Test whether RDP (3389) or VNC (5900) responds from outside using AdminKit’s port check tool, against systems you own or are authorized to test only.
3. If either responds and wasn’t meant to be public, remove the direct port forward on your router or firewall immediately — this is the single highest-leverage fix, independent of password strength.
4. Require multi-factor authentication on any remote-access path that remains, since CISA’s advisory names MFA specifically as a mitigating control for this exact risk.
5. Route remote access through a VPN or managed access broker instead of a direct forward, so the protocol’s login prompt is never the first thing an internet scanner finds.

A single clean port-check result also isn’t permanent if your network’s public IP changes or is shared — see our CGNAT guide for how that affects whether a check from last week still describes your situation today.

Where AdminKit fits

For a small office or home-office setup where someone genuinely needs remote desktop access to a work machine, the fix isn’t “never use RDP” — it’s “never expose RDP’s login prompt directly.” AdminKit’s planned OT Remote Access product is built around exactly this pattern: authenticated, audited remote access without a forwarded port for an attacker to find. See our small office security page for the broader picture of what’s free to check today versus what’s planned.