Unparalleled RDP Monitoring Reveals Attackers' Tradecraft
Gozint and ESET researchers use PyRDP to record and classify over 100 hours of attacker sessions on exposed RDP honeypots into behavioral archetypes.
Summary
The Primacy of RDP in Ransomware Intrusions
Exposed Remote Desktop Protocol (RDP) services represent one of the most frequent initial access vectors exploited by cybercriminals and opportunistic ransomware operators.
Deploying PyRDP for In-Depth Session Interception
Maxime Bergeron and Olivier Bilodeau deploy PyRDP, an open-source man-in-the-middle RDP proxy that records keystrokes, clipboard transfers, mapped drives, and video playback of live intrusions.
Categorizing Attacker Archetypes via D&D Taxonomy
Analyzing over 100 hours of video recordings reveals distinct behavioral archetypes—ranging from noisy brute-force 'Barbarians' to stealthy reconnaissance 'Rangers' and proxying 'Wizards'.
Translating Honeypot Telemetry into Blue-Team Defenses
Documenting common command sequences, tooling artifacts, and monetization strategies enables defensive teams to build robust detection rules against real-world lateral movement.
Related talks
Main Stage·36 min
Jon DiMaggio
Inside account of a two-year undercover operation infiltrating the LockBit ransomware syndicate and profiling its leadership.
Main Stage·39 min
Vangelis Stykas
Vulnerabilities and offensive disruption techniques targeting the web management panels of active ransomware operations.
Main Stage·45 min
Chad Seaman
Akamai researcher Chad Seaman presents UPnProxyPot, a Golang honeypot that impersonates vulnerable UPnP routers to intercept and MITM blackhat proxy networks.