Tag: rdp exploitation

2 Attack Reports | 0 Vulnerabilities

Attack reports

Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses

Makop, a ransomware strain derived from Phobos, is targeting Indian businesses through exposed RDP systems. The attackers employ a diverse toolkit including network scanners, privilege escalation exploits, and AV killers. They have integrated GuLoader, a downloader trojan, to deliver secondary payl…

privilege escalation

credential dumping

network scanning

rdp exploitation

Published: December 9, 2025

Linked vulnerabilities : CVE-2020-0787, CVE-2025-7771 (CVSS 8.7), CVE-2016-0099, CVE-2020-1066, CVE-2018-8639, CVE-2020-0796, CVE-2019-1388, CVE-2021-41379, CVE-2022-24521, CVE-2017-0213

Downloadable IOCs: 62

APT Group Profiles - Larva-24005

A new operation named Larva-24005, linked to the Kimsuky group, has been discovered by ASEC. The threat actors exploited RDP vulnerabilities to infiltrate systems, installing MySpy malware and RDPWrap for continuous remote access. They also deployed keyloggers to record user inputs. The group has b…

rdp exploitation

Published: April 22, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports