Threats Tagged 'remote desktop services'

Threat actors exploited a SQL injection vulnerability in a technology sector organization's web application to gain initial access. They compromised an MSSQL instance via inadequate input validation and used base64-encoded PowerShell scripts for reconnaissance and data exfiltration. Persistence was established by enabling Remote Desktop Services, creating an admin-level user account, and disabling Windows Defender. The attackers installed BadIIS modules for SEO fraud and deployed the XMRig cryptocurrency miner with hidden file attributes. Multiple PowerShell scripts and batch files were used throughout the attack to maintain access and facilitate malicious operations.