By: Huntress Tactical Response Team To most defenders, another brute-force alert on exposed RDP is background noise — bread-and-butter activity you triage and move past. For the Huntress Tactical Response Team, one of those “routine” alerts turned into something very different. As we pulled on a single successful login, we uncovered unusual credential-hunting behavior, a web of geo-distributed infrastructure, and a shady VPN service that all pointed toward a ransomware-as-a-service ecosystem and its initial access brokers. This post walks through how a noisy brute-force campaign became our doorway into that operation. Attack Narrative In this case, a network was exposing a Remote Desktop (RDP) server to the broader internet. We’ve talked about the dangers of this dynamic through different…