RansomHub Deployed After RDP Password-Spray Intrusion
RDP password spraying led to credential theft, Rclone data exfiltration, and network-wide RansomHub ransomware deployment via SMB, per DFIR Report analysis.
The DFIR Report detailed a November 2024 intrusion that began with a four-hour password-spray attack against an internet-facing RDP server, ultimately compromising six accounts. After gaining an elevated-token session, the threat actor used living-off-the-land commands (net, nltest, nslookup) alongside Mimikatz and Nirsoft's CredentialsFileView to harvest credentials and interact with LSASS memory, and used Advanced IP Scanner and SoftPerfect NetScan for network discovery. The actor moved laterally via RDP to domain controllers, backup servers, and file servers, eventually establishing persistence through legitimate RMM tools Atera and Splashtop.
On day three, the actor staged Rclone with helper scripts (nocmd.vbs, rcl.bat) to exfiltrate roughly 2.03GB of documents, spreadsheets, emails, and images over SFTP disguised on port 443 to a remote server. After further reconnaissance and password resets across multiple accounts, the actor deployed a RansomHub ransomware binary (amd64.exe) on day six. The malware killed hypervisor VMs, deleted shadow copies, cleared event logs, modified symlink behavior, and propagated network-wide via SMB and remote services before encrypting files and dropping a RansomHub ransom note.
Total time-to-ransomware was approximately 118 hours across six days. The report provides detailed indicators, Sigma/YARA detections, and MITRE ATT&CK mappings, illustrating a typical RansomHub affiliate playbook combining commodity credential-theft tools, legitimate RMM software for stealth persistence, and SMB-based ransomware propagation.
Mentioned in this report
Detection guidance
Mimikatz or Nirsoft Credential Harvesting Tool Execution
Execution of known credential-dumping tools (Mimikatz, CredentialsFileView) that directly access LSASS memory or stored credentials — typical post-compromise credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mimikatz or Nirsoft Credential Harvesting Tool Execution
description: Detects execution of Mimikatz or Nirsoft CredentialsFileView, tools commonly
used to dump LSASS memory and extract stored credentials post-breach.
tags:
- attack.credential-access
- attack.t1003.001
- attack.t1003.006
logsource:
category: process_creation
product: windows
detection:
selection_mimikatz:
Image|endswith: \mimikatz.exe
selection_credentialsfileview:
Image|endswith: CredentialsFileView.exe
condition: 1 of selection_*
falsepositives:
- Authorized red-team or pentesting exercises
- Security research in isolated labs
level: high
id: bde22185-c68f-5fdd-9864-7a275f515a22
status: experimental
author: Vorant
Rclone Staged with Batch/VBS Helper Scripts for Exfiltration
Rclone binary execution accompanied by helper batch or VBS scripts (nocmd.vbs, rcl.bat) staging data exfiltration — distinctive lateral-staging pattern for bulk file transfers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Staged with Batch/VBS Helper Scripts for Exfiltration
description: "Detects Rclone process creation preceded or accompanied by execution\
\ of batch/VBS helper scripts (nocmd.vbs, rcl.bat, etc.) \u2014 pattern typical\
\ of staged exfiltration via Rclone over alternative protocols."
tags:
- attack.exfiltration
- attack.t1570
- attack.t1048
logsource:
category: process_creation
product: windows
detection:
selection_rclone:
Image|endswith: rclone.exe
selection_helpers:
Image|endswith:
- nocmd.vbs
- rcl.bat
condition: 1 of selection_*
falsepositives:
- Legitimate cloud-backup or sync tools using Rclone with internal helper scripts
- IT automation deploying Rclone for scheduled data migration
level: medium
id: 8ef41067-acca-5d21-b4eb-db6f0a7e6853
status: experimental
author: Vorant
Ransomware Post-Exploitation Activity: Shadow Copy Deletion and Event Log Clearing
Execution of vssadmin delete shadows and wevtutil cl commands — post-exploitation preparation before encryption to destroy recovery points and remove forensic traces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: 'Ransomware Post-Exploitation Activity: Shadow Copy Deletion and Event Log
Clearing'
description: "Detects vssadmin delete shadows and wevtutil cl (clear event log) commands\
\ executed in sequence or close temporal proximity \u2014 strong indicator of pre-encryption\
\ preparation by ransomware."
tags:
- attack.impact
- attack.t1490
- attack.t1070.001
logsource:
category: process_creation
product: windows
detection:
selection_vss:
Image|endswith: vssadmin.exe
CommandLine|contains: shadows
selection_wevtutil:
Image|endswith: wevtutil.exe
CommandLine|contains: cl
filter_admin_maintenance:
User|contains:
- SYSTEM
- NT AUTHORITY
condition: (1 of selection_*) and not filter_admin_maintenance
falsepositives:
- Scheduled maintenance scripts clearing old shadow copies in some enterprises
- IT-approved disk cleanup utilities running as elevated service accounts
level: high
id: 05349862-6d23-5b25-a666-0de43ea4dd77
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free