Still RDP, still brute force, still working
Phobos operators scan the internet for exposed Remote Desktop with off-the-shelf tools such as Angry IP Scanner, brute force whatever they find, and walk in on valid credentials. From there it is SmokeLoader, Cobalt Strike, Bloodhound and Mimikatz, then exfiltration through WinSCP and Mega before the encryption anyone eventually notices.
What worked
Nothing novel had to be defended against, and that is the useful part. Every stage of this uses public tooling that mature detection catches: Mimikatz touching LSASS, Bloodhound enumerating the directory, Cobalt Strike beaconing. Organisations with an EDR that somebody watches routinely stop Phobos at the second or third step. The playbook is entirely known, which means the outcome is a function of whether the controls were deployed, not of whether the adversary was clever.
What failed
The front door. RDP published straight to the internet with password authentication and no MFA, no lockout worth the name, and no rate limiting, on estates too small to have anyone watching the authentication logs. This is not a sophisticated intrusion and it has not needed to be for a decade; it persists because the exposure persists. Backups are usually the second failure: reachable from the same domain with the same credentials, and encrypted alongside everything else.
The number
67%
of Rapid7's Q3 2024 incident responses involved valid accounts with missing or weakly enforced MFA on remote access.
What to do instead
Scan your own perimeter from outside and find the RDP you do not know about, because there almost always is some: a vendor's jump box, a forgotten test server, an acquisition nobody folded in. Put remote access behind a VPN or a gateway with phishing-resistant MFA and take 3389 off the internet entirely. Then fix the backups properly: offline or immutable, and restorable by an account that domain compromise cannot reach. Test a restore this quarter. An untested backup is a belief, and this is the family that finds out.