VORANT. Threat Intelligence Sign in Get the full feed

RansomHub hits via RDP password spray

high threat

A password spray against exposed RDP led to credential theft, lateral movement across domain controllers, Rclone exfiltration of 2GB, and RansomHub ransomware deployment over SMB in 118 hours.

In November 2024, a threat actor conducted a four-hour password spray attack against an internet-facing RDP server, successfully compromising six accounts. Using one account with elevated privileges, they deployed Mimikatz and NirSoft CredentialsFileView to harvest credentials from LSASS memory and stored credential files. The actor leveraged RDP to move laterally to domain controllers, where they accessed DNS management consoles and continued credential harvesting across child domains. Discovery was accomplished through living-off-the-land binaries (net, nltest, nslookup) and third-party tools including Advanced IP Scanner and SoftPerfect NetScan.

Over the following days, the threat actor installed Atera and Splashtop for persistent remote access on backup servers. On day three, they deployed Rclone with helper scripts to exfiltrate 2.03 GB of documents, spreadsheets, emails, and images over SFTP to 38.180.245.207:443. The actor reset multiple user passwords across domain controllers before the final stage. On day six, they deployed RansomHub ransomware (amd64.exe) which propagated via SMB to remote hosts using automated remote service execution. The ransomware killed running VMs, deleted shadow copies, cleared event logs, and encrypted files network-wide. Time to ransomware was approximately 118 hours across six calendar days, demonstrating methodical preparation before impact operations.

Mentioned in this report

Malware MimikatzRansomHubRclone

Detection guidance

Credential Dumping Tool Execution (Mimikatz / NirSoft CredentialsFileView)

ATT&CK T1003.001

Detects execution of known LSASS credential-harvesting tools (Mimikatz, NirSoft CredentialsFileView) observed after RDP-based lateral movement. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Dumping Tool Execution (Mimikatz / NirSoft CredentialsFileView)
id: 2e2602f3-ad26-582a-a502-03497e290595
status: experimental
description: Detects process execution or command-line indicators of Mimikatz or NirSoft
  CredentialsFileView used to harvest credentials from LSASS memory or stored credential
  files, as seen in RansomHub intrusions following RDP compromise.
references:
- RansomHub RDP password spray intrusion report
logsource:
  category: process_creation
  product: windows
detection:
  selection_mimikatz:
  - CommandLine|contains:
    - sekurlsa::logonpasswords
    - 'sekurlsa::'
    - 'lsadump::'
    - privilege::debug
  - Image|endswith:
    - \mimikatz.exe
  selection_nirsoft:
    Image|endswith: \CredentialsFileView.exe
  condition: 1 of selection_*
falsepositives:
- Authorized penetration testing or red team engagements using Mimikatz
- Legitimate use of NirSoft utilities by IT staff for credential recovery (rare in
  production environments)
level: high
tags:
- attack.t1003.001
- attack.credential_access
author: Vorant

Domain Trust and Account Discovery via LOLBins Chain

ATT&CK T1482

Detects sequential use of nltest, net, and nslookup to enumerate domain trusts, groups, and DNS infrastructure across child domains, matching post-compromise discovery activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Domain Trust and Account Discovery via LOLBins Chain
id: 34f97ff2-aa74-5989-89f4-62c027a18be5
status: experimental
description: Detects living-off-the-land discovery commands (nltest domain trusts/dclist
  enumeration, net group domain queries, nslookup) frequently used together by threat
  actors after gaining domain admin or elevated access via RDP lateral movement.
references:
- RansomHub RDP password spray intrusion report
logsource:
  category: process_creation
  product: windows
detection:
  selection_nltest:
    Image|endswith: \nltest.exe
    CommandLine|contains:
    - /domain_trusts
    - /dclist
    - /trusted_domains
  selection_net_group:
    Image|endswith: \net.exe
    CommandLine|contains:
    - group
    - /domain
  selection_nslookup:
    Image|endswith: \nslookup.exe
  condition: 1 of selection_*
falsepositives:
- IT administrators troubleshooting DNS or domain trust relationships
- Scheduled scripts performing routine domain health checks
level: medium
tags:
- attack.t1482
- attack.t1087.002
- attack.t1069.002
- attack.discovery
author: Vorant

Shadow Copy Deletion and Windows Event Log Clearing Prior to Ransomware Impact

ATT&CK T1490

Detects the combination of shadow copy/backup deletion and event log clearing commands typically executed immediately before ransomware encryption to inhibit recovery and remove forensic evidence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shadow Copy Deletion and Windows Event Log Clearing Prior to Ransomware Impact
id: 1fa85ac1-0c1e-53f6-a44f-8379225bc418
status: experimental
description: Detects vssadmin/wbadmin shadow copy or backup catalog deletion combined
  with wevtutil event log clearing, a pattern used by RansomHub and similar ransomware
  operators immediately before encrypting files network-wide.
references:
- RansomHub RDP password spray intrusion report
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow_delete:
    Image|endswith:
    - \vssadmin.exe
    - \wbadmin.exe
    - \wmic.exe
    CommandLine|contains:
    - delete shadows
    - delete catalog
    - shadowcopy delete
    - resize shadowstorage
  selection_log_clear:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - 'cl '
    - clear-log
    - ' cl system'
    - ' cl security'
    - ' cl application'
  condition: selection_shadow_delete or selection_log_clear
falsepositives:
- Legitimate backup software performing scheduled shadow copy maintenance (rare to
  combine with log clearing)
- System administrators clearing logs for disk space management (uncommon and should
  be verified)
level: high
tags:
- attack.t1490
- attack.t1070.001
- attack.t1070
- attack.impact
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free