Ukrainian Critical Infrastructure, European Government and European Critical Infrastructure: Russian Hackers Exploit RDP and VPNs to Breach Target Networks

Russian Hackers Exploit Exposed RDP and VPN Gateways for Espionage and Ransomware

Russian state-sponsored and criminal hacking groups are increasingly targeting exposed Remote Desktop Protocol (RDP) services and vulnerable VPN gateways as primary entry points into corporate and government networks. These compromised access points are then resold or weaponized for espionage, ransomware attacks, and other malicious activities.

Threat actors, including initial access brokers, systematically scan the internet for misconfigured RDP ports and poorly secured VPN gateways, exploiting weak passwords, outdated software, and unpatched vulnerabilities. Automated botnets, leveraging over 100,000 unique IP addresses, conduct brute-force and credential-stuffing attacks, making it difficult for defenders to block malicious traffic based on IP filtering alone.

Once access is gained, compromised RDP and VPN credentials are often harvested and auctioned on Russian-language underground forums. Brokers tag these credentials with details such as company size, location, and privilege levels, selling them to ransomware affiliates and advanced persistent threat (APT) groups. Recent intelligence reports indicate that RDP remains a dominant access vector, with VPN credentials rapidly gaining traction as organizations expand remote access infrastructure.

In recent operations targeting European and Ukrainian government and critical infrastructure networks, Russian-aligned groups have combined phishing attacks with VPN and RDP exploitation. Phishing lures trick users into opening malicious RDP files or interacting with fake portals, while attackers simultaneously scan for exposed remote access services. This approach allows ransomware groups to bypass initial reconnaissance, moving directly to high-value targets with pre-compromised credentials.

Ukrainian and European cyber agencies have documented multiple incidents in 2025 where Russian-speaking actors gained access via RDP or VPN, followed by lateral movement and the deployment of ransomware strains such as X2 and LockBit 3.0. Defenders face the challenge of countering both large-scale automated attacks and targeted intrusions by skilled APT groups, underscoring the need for robust security controls.

Source: https://cyberpress.org/russian-hackers-exploit-access/

European Union Agency for Cybersecurity (ENISA) cybersecurity rating report: https://www.rankiteo.com/company/european-union-agency-for-cybersecurity-enisa

National Cybersecurity Coordination Center (NCSCC) cybersecurity rating report: https://www.rankiteo.com/company/ncscc

"id": "EURNCS1779445606",
"linkid": "european-union-agency-for-cybersecurity-enisa, ncscc",
"type": "Ransomware",
"date": "1/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': ['Government', 'Various'],
                        'location': ['Europe', 'Ukraine'],
                        'type': ['Government',
                                 'Corporate',
                                 'Critical infrastructure']}],
 'attack_vector': ['Exposed RDP', 'Vulnerable VPN gateways', 'Phishing'],
 'description': 'Russian state-sponsored and criminal hacking groups are '
                'increasingly targeting exposed Remote Desktop Protocol (RDP) '
                'services and vulnerable VPN gateways as primary entry points '
                'into corporate and government networks. These compromised '
                'access points are then resold or weaponized for espionage, '
                'ransomware attacks, and other malicious activities.',
 'impact': {'systems_affected': ['Corporate networks',
                                 'Government networks',
                                 'Critical infrastructure']},
 'initial_access_broker': {'data_sold_on_dark_web': ['Compromised RDP '
                                                     'credentials',
                                                     'VPN credentials'],
                           'entry_point': ['Exposed RDP',
                                           'Vulnerable VPN gateways']},
 'motivation': ['Espionage',
                'Financial gain',
                'Disruption of critical infrastructure'],
 'post_incident_analysis': {'root_causes': ['Weak passwords',
                                            'Outdated software',
                                            'Unpatched vulnerabilities',
                                            'Misconfigured RDP ports']},
 'ransomware': {'ransomware_strain': ['X2', 'LockBit 3.0']},
 'references': [{'source': 'Intelligence reports'}],
 'threat_actor': ['Russian state-sponsored hackers',
                  'Russian criminal hacking groups',
                  'Initial access brokers'],
 'title': 'Russian Hackers Exploit Exposed RDP and VPN Gateways for Espionage '
          'and Ransomware',
 'type': ['Espionage', 'Ransomware'],
 'vulnerability_exploited': ['Weak passwords',
                             'Outdated software',
                             'Unpatched vulnerabilities',
                             'Misconfigured RDP ports']}