Logins for 1.3 million Windows RDP servers collected from hacker market

​The login names and passwords for 1.3 million current and historically compromised Windows Remote Desktop servers have been leaked by UAS, the largest hacker marketplace for stolen RDP credentials.

With this massive leak of compromised remote access credentials, researchers, for the first time, get a glimpse into a bustling cybercrime economy and can use the data to tie up loose ends on previous cyberattacks.

Network admins will also benefit from a new service launched by cybersecurity firm Advanced Intel called RDPwned that allows organizations to check whether their RDP credentials have been sold in the marketplace.

What's so special about RDP?

Remote Desktop Protocol (RDP) is a Microsoft remote access solution that allows users to remotely access a Windows device's applications and desktop as if they were sitting in front of the computer.

Due to its prevalent use in corporate networks, cybercriminals have built a thriving economy around selling the stolen credentials for RDP servers.

While you may think that access to a corporate network would be expensive, the reality is that threat actors sell remote desktop accounts for as little as $3 and typically not more than $70.

Once a threat actor gains access to a network, they can perform a variety of malicious activities. These activities include spreading further throughout the network, stealing data, installing point-of-sale (POS) malware to harvest credit cards, installing backdoors for further access, or deploy ransomware.

The use of Windows Remote Desktop Services to breach networks is so pervasive that the FBI has stated that RDP is responsible for 70-80% of all network breaches leading to ransomware attacks.

While all ransomware groups utilize RDP to some extent, one ransomware group known as Dharma is known to predominantly use remote desktop to gain a foothold in corporate networks.

UAS, the largest marketplace for RDP credentials

UAS, or 'Ultimate Anonymity Services,' is a marketplace that sells Windows Remote Desktop login credentials, stolen Social Security Numbers, and access to SOCKS proxy servers.

What makes UAS stand out is that it is the largest such marketplace, performs manual verification of sold RDP account credentials, offers customer support, and provides tips on how to retain remote access to a compromised computer.

"The market functions partially like eBay - a number of Suppliers work with the market. They have a separate place to log in and upload the RDPs they hacked. The system will then verify them, collect information about each one (os, admin access? internet speed, cpu, memory etc etc), which is added to the listing."

"The supplier interface provides real time stats for the suppliers (what sold, what didn't, what was sold but a refund was asked for, etc)."

"They also provide support if for some reason what you bought doesn't work. They do take customer support seriously," a security researcher who wishes to remain anonymous told BleepingComputer.

When purchasing stolen RDP accounts, threat actors can search for compromised devices in a particular country, state, city, zip code, ISP, or operating system, allowing them to find the specific server they need.

Potential buyers can dig down deeper on each server to see the number of Windows accounts, the Internet connection speed, the server's hardware, and more, as shown below.

BleepingComputer was told that the marketplace will not sell any servers located in Russia or a Commonwealth of Independent States (CIS) country and runs a script that automatically removes any that are found.

Even with this filtering of servers, UAS is currently selling a massive 23,706 RDP credentials.

Secretly monitoring the UAS marketplace

Since December 2018, a group of security researchers have had secret access to the database for the UAS marketplace and have been quietly collecting sold RDP credentials for almost three years.

During this time period, the researchers have collected the IP addresses, usernames, and passwords, for 1,379,609 RDP accounts that have been sold at UAS since the end of 2018.

This database had been shared with Advanced Intel's Vitali Kremez, who also shared a redacted copy with BleepingComputer to review.

While we will not be listing any of the companies found in the database, we can say that the listed RDP servers are from all over the world, including government agencies from sixty-three countries, with Brazil, India, and the United States being the top three.

There are also RDPs servers for many well-known, high-profile companies, with many servers from the healthcare industry.

Furthermore, BleepingComputer has found many RDP servers in the database that belong to organizations known to have suffered ransomware attacks over the past two years.

After analyzing the 1.3 million accounts in the database, BleepingComputer has pulled out some interesting data that should be useful for all computer users and network admins:

• The top five login names found in the sold RDP servers are 'Administrator', 'Admin', 'User', 'test', and 'scanner'.
• The top five passwords used by the RDP servers are '123456', '123', 'P@ssw0rd', '1234', and 'Password1'.
• The top five represented countries in the database are United States, China, Brazil, Germany, India, and the United Kingdom.

More complete stats are found at the end of the article.

RDPwned: Checking if your RDP is compromised

Vitali Kremez has launched a new service called RDPwned that allows companies and their admins to check if their servers are listed in the database.

"The marketplace is tied to a number of high-profile breaches and ransomware cases across the globe. A number of ransomware groups are known to purchase initial access on UAS. This treasure trove of adversary-space data provides a lens into the cybercrime ecosystem, and confirm that low hanging fruit, such as poor passwords, and internet-exposed RDP remain one of the leading causes of breaches,"

"RDPwned will also help illuminate old breaches for which they never figured out initial access. For others, it will give them a chance to resolve the security problem before it becomes a breach," Kremez told BleepingComputer.

To use the service, Kremez told BleepingComputer that companies would need to submit contact information from an executive or admin of the company, which Advanced Intel will vet.

Once the user's identity is verified, Advanced Intel will confirm if their company's servers are listed in RDPwned.

Visitors can perform this lookup via reverse DNS, IP addresses, and domain names.

Further statistics

Below are additional statistics showing the top 20 login names, top 20 passwords, and top 10 countries found in the 1.3 million RDP servers that UAS has listed on the marketplace.

Top 20 login names

Used login name	Total accounts
Administrator	303,702
Admin	59,034
User	45,096
test	30,702
scanner	20,876
scan	16,087
Guest	12,923
IME_ADMIN	9,955
user1	8,631
Administrador	8,612
Trader	8,608
postgres	5,853
IME_USER	5,667
Usuario	5,236
user2	4,055
Passv	3,989
testuser	3,969
test1	3,888
server	3,754
student	3,592
reception	3,482
backup	3,356
openpgsvc	3,339
info	3,156
VPN	3,139

Top 20 passwords

Used password	Total accounts
123456	71,639
123	50,449
P@ssw0rd	47,139
1234	34,825
Password1	27,007
1	24,955
password	19,148
12345	16,522
admin	15,587
ffff-ffc0M456x (see note)	15,114
Admin@123	13,572
User	13,437
scanner	13,193
scan	10,409
test	10,169
Aa123456	9,399
Password123	8,756
12345678	8,647
Admin123	8,214
Passw0rd	7,817
admin,.123!@#$%^	7,027
1qaz@WSX	6,248
Welcome1	5,962
P@ssword64	5,522
abc@123	4,958

Note: The 'ffff-ffc0M456x' password appears to be a default password configured by the MailEnable setup program for remote access. Users are advised to change this password to something else.

Top 10 countries

Country	Total Accounts
United States	299,529
China	201,847
Brazil	119,959
Germany	56,225
India	41,588
United Kingdom	37,810
France	32,738
Spain	30,312
Canada	27,347
Hong Kong	24,804