RDP Spray and Pray: Research on Modern RDP Attacks From Spray to Exploit

Tess Mishoe, an AI security researcher and engineer on Cisco's Duo team, traces Remote Desktop Protocol from its 1998 debut through BlueKeep and the later addition of MFA. She explains the common attack paths: credential brute forcing with common tools, exploiting old vulnerabilities, lateral movement using stolen access, and denial of service that can trigger fail-open conditions when MFA breaks down.

The middle of the talk turns to authentication data from a large set of MFA-protected RDP environments. Mishoe describes broad spray campaigns that cycle through users to avoid lockouts, MFA fatigue through repeated push prompts, and quiet single-account attempts that succeed because of leftover bypass settings. She reviews where attempts originate, which industries are hit hardest, such as manufacturing and IT services, and how her team labels traffic to train a detection model, with human review at each step.

She closes with practical defenses: keep RDP off the open internet, keep MFA enabled despite its limits, audit permissions and bypass rules regularly, and tighten conditional access and device enrollment. Her main point is that automation helps detection, but analysts are still needed to recognize new patterns.