xDedic, a dark marketplace for selling credentials for remote access and hacked servers was taken down by US and European law enforcement. Law enforcement took possession of “several IT systems and three Ukrainian suspects were questioned,” according to EuroJust, a European Union intra jurisdictional agency that coordinates criminal matters between EU countries. The action was augmented by the FBI, the IRS, Europol, and regional law enforcement authorities in Belgium and Ukraine. The domains of xDedic were seized on Jan. 24.

xDedic: A Key Source of Hacked Credentials That Lead to Ransomware Attacks

Xdedic Rdp Patch V2.1

Hacked Remote Desktop Protocol credentials purchased from sites like xDedic, have long been a suspected origin of ransomware attacks. In Q4, bruteforce RDP access accounted for almost 85% of ransomware attacks. Ransomware distribution crews purchase access to server’s that have been previously breached as a compliment to their own brute forcing attempts. xDedic offers credentials for as little as $5-10 each.

According to a statement by the United States Attorney’s Office for the Middle District of Florida, “the marketplace facilitated more than $68 million in fraud, impacting victims in multiple industries, including local, state, and federal government infrastructure, hospitals, 911 and emergency services, call centers, major metropolitan transit authorities, accounting and law firms, pension funds, and universities.” Even though individual transactions facilitated on the site were small, the credentials were used to launch major breaches and ransomware attacks.

Xdedic Rdp Patch

In a followup June 20 blog, the security firm explained why the amount of credentials exposed could be higher than originally estimated (see: Compromised RDP Server Tally From xDedic May Be Higher). There are over 85,000 RDP servers available for sale or rent via xDedic, a marketplace for selling or renting hacked servers that was exposed in June 2016. Now that you are in the RDP and you have selected an RDP with Admin Rights, it is time to patch the RDP so you can create your own account to do your dirty work on. In order to do this open a browser (use incognito mode so it won’t track history) go to this link inside the RDP’s browser and download it.

REMOTE DESKTOP PROTOCOL xDedic also provides its members with RDP (Remote Desktop Protocol) patches to redirect incoming traffic to obscure the sources of the attackers and customers, as well as to allow multiple hidden RDP connections to the compromised servers. RDP credentials are the primary type of accounts that are being sold on the. The xDedic marketplace is a predominant cybercriminal marketplace on the dark web known for hosting sales of access to compromised Remote Desktop Protocol (RDP) servers. RDP is Microsoft’s proprietary protocol that provides users with a graphical interface to connect to another computer over a network connection.

Up and Down History of xDedic as a Criminal Marketplace

xDedic started in 2014, but was closed for a period of time in 2016 after Kaspersky wrote a detailed report about its operations. It re-surfaced shortly thereafter with a new paywall, requiring members to pay $50 to join. The site was also moved to the Tor network for enhanced anonymity. Even though this prolific marketplace has been closed, there are other marketplaces that provide similar services, such a MagBo. Purchasing stolen credentials will likely move to other avenues and the RDP attack vector will continue to be exploited.

Securing RDP Remains Critical to Defend Against Ransomware

Xdedic Rdp Patch Download Pes

Xdedic Rdp Patch Download Torrent

Even though a major sources of stolen RDP credentials is down, its effect on reducing ransomware may be minimal. It remains critical that business take a layered approach to securing remote access. We recommend the following:

Limit RDP Access: Limit access by requiring a VPN to access RDP. The default port number should be changed as well. Access should be granted to a select whitelist of IP ranges and lockout provisions enacted so that brute forcing attempts trigger lock out or admin alerts.
Two-factor authentication (2FA): The vast majority of corporate ransomware attacks could be thwarted by enabling two-factor authentication on remote sessions and all remotely-accessible accounts.
Endpoint & alternative solutions: Today’s endpoint solutions can detect anomalies in network usage (such as an in-office workstation attempting opening a RDP session) and stop them before damage is done. Additionally, several new products offer alternatives for remote access that are more secure than RDP.
Least Privilege: Users that do not need to service important internal services should not have access to them. Double check your permissions and make sure employees have the minimum access required to complete their job. Accounts that can access critical systems, including backups, should have 2FA on them.
Disaster Recovery: Should RDP configurations become compromised, it’s critical that a company’s BCDR plans be codified and up to date. Backup systems should have up-to-date, on-site and off-site versions of all critical data. IR firms should be kept on retainer to minimize costs and time to recover in the event of a breach.