Windows malware opens RDP ports on PCs for future remote access

guest · May 22, 2020

Windows malware opens RDP ports on PCs for future remote access
Security experts believe the malware's operators are very likely to sell access to infected hosts to other hacker groups
May 22, 2020
https://www.zdnet.com/article/windows-malware-opens-rdp-ports-on-pcs-for-future-remote-access/

Security researchers say they've spotted a new version of the Sarwent malware that opens RDP (Remote Desktop Protocol) ports on infected computers so hackers could gain hands-on access to infected hosts.

Researchers from SentinelOne, who spotted this new version, believe the Sarwent operators are most likely preparing to sell access to these systems on the cybercrime underworld, a common method of monetizing RDP-capable hosts.
THE SARWENT MALWARE
The Sarwent malware is a lesser-known backdoor trojan that has been around since 2018. In its previous versions, the malware contained a limited set of functionality, such as having the ability to download and install other malware on compromised computers.
Click to expand...

But in a recent campaign spotted over the past weeks, SentinelOne malware analyst Jason Reaves says Sarwent received two critical updates.

The first is the ability to execute custom CLI commands via the Windows Command Prompt and PowerShell utilities.
Reaves says Sarwent now registers a new Windows user account on each infected host, enables the RDP service, and then modifies the Windows firewall to allow for external RDP access to the infected host.
Click to expand...

RDP ACCESS FOR WHAT?
Currently, it still remains a mystery what Sarwent is doing with the RDP access it is gaining on all infected hosts.

"Normally, development of malware in the crimeware domain is determined by the desire to monetize something, or by customer demand for functionality," Reaves told ZDNet.
Click to expand...

SentinelLabs: Sarwent Malware Continues to Evolve With Updated Command Functions

Sarwent has received little attention from researchers, but this backdoor malware is still being actively developed, with new commands and a focus on RDP.
Click to expand...

Log in or Sign up

Windows malware opens RDP ports on PCs for future remote access

guest Guest

Log in or Sign up

Windows malware opens RDP ports on PCs for future remote access

guest Guest

Useful Searches