Hello, welcome to the Friday, June 7th, 2019 edition of the Santernut Storm Center's Stormcast. My name is Johannes Ulrich,

and I'm recording from Jacksonville, Florida. I noted a couple times talking about Blue Keep and the

RDP vulnerability in general that you probably shouldn't expose RDP to the public internet.

Latest example of why this is a bad idea is a botnet that Renato came across and he called

it Gold Brood based on a Java library that it uses to actually do its scanning.

This botnet is actually a little bit more intricate than some of these botnets.

First of all, it's written in Java, which is a little bit unusual, and comes with the entire

Java runtime.

So the download for each individual host is about 80 megabytes in size, and that's the SIPP archive of everything

that's then being expanded on the infected host. Now, once a host is infected, it starts scanning

for other systems that have an open RDP port, and it reports this back to a command control server.

Now, once it reported back 80 IP addresses, then this command and control server will actually

start pushing IP address back to the RDP host. I think there's a little bit of proof that this host is actually actively scanning

and not just a honeypot. So that may be the reason that it first wants these ATIP addresses back. And

then the host, the command control server is pushing back more IP addresses that the infected system is then scanning

for a weak passwords. Each time the host is just using one pair of username and password,

so that probably will work around some lockout issues here, and then later it will receive another list of IP addresses.

Renato of course, well he did send back 80 IP addresses, got back more and more addresses

to scan.

Overall he ended up with about 1.5 million servers that are exposed according to this botnet.

So these 1.5 million servers are now being scanned for weak passwords.

And of course this list is going to get larger as infected systems are scanning for more and more hosts that have RDP exposed.

...