{"id":13667,"date":"2022-10-28T14:16:23","date_gmt":"2022-10-28T14:16:23","guid":{"rendered":"https:\/\/www.realvnc.com\/?post_type=blog&p=13667"},"modified":"2024-02-20T10:34:38","modified_gmt":"2024-02-20T10:34:38","slug":"new-venus-ransomware-gang-focuses-internet-facing-windows-remote-desktop-services","status":"publish","type":"blog","link":"https:\/\/www.realvnc.com\/en\/blog\/new-venus-ransomware-gang-focuses-internet-facing-windows-remote-desktop-services\/","title":{"rendered":"New “Venus” Ransomware Gang Focuses on Internet-Facing Windows Remote Desktop Services"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

You\u2019d think by now that RDP exposed to the Internet would be dead \u2013 after all, it\u2019s a known fact (if you\u2019re paying attention at all) that RDP and Phishing remain deadlocked in a battle for supremacy as the top initial attack vector<\/a> in ransomware attacks. And yet, even IT folks are leaving RDP sessions open<\/a> (thinking that using an alternate port will somehow obfuscate the fact that the service is Windows\u2019 Remote Desktop service.<\/p>\n

What does “Venus” do?<\/h2>\n

According to Bleeping Computer, a new ransomware gang, known as \u201cVenus\u201d, has sprouted up since August of this year, focusing their attack efforts on exposed RDP sessions<\/a> (and, no, the port doesn\u2019t matter; the threat actors scan every port looking at the response to determine it\u2019s an RDP connection).  Once within the victim network, Venus attempts to terminate 39 processes that may lock files (thus, keeping them from being able to be encrypted), deletes event logs, kills the Shadow Volume copies, and disables Data Execution protection \u2013 all before beginning the encryption of your data.<\/p>\n

What to keep in mind<\/h2>\n

Organizations requiring any kind of remote access<\/a> for their users should consider the use of remote access services that provide a number of security controls to ensure that, should a threat actor identify an Internet-facing remote service, they are unable to take advantage of the connection.  The controls include:<\/p>\n