In Uzbekistan, mass cyberattacks aimed at unauthorized access to computers and servers of state organizations and economic entities via the RDP service have been detected. This was reported by the UZCERT service of the Cyber Security Center.
According to the report, specialists identified a number of foreign IP addresses belonging to the malicious C2 infrastructure used to manage the attacks.
According to preliminary analyses, information systems of some organizations were compromised as a result of the attacks. In particular, data stored on some servers and computers were encrypted.
Currently, investigation and analysis work on situations related to cyberattacks is ongoing.
UZCERT recommended that employees responsible for cybersecurity in state organizations and companies strengthen security measures for the RDP service.
In particular, it was requested to temporarily disable RDP if not needed, or restrict direct internet access to it, and allow access to the service only from trusted IP addresses or via VPN.
It was also emphasized the need to enable the NLA function, not leave port 3389 open to the internet, use complex passwords for administrator and RDP user accounts, and implement multi-factor authentication.
Specialists recommended that organizations monitor network activity through systems such as Firewall, IDS/IPS, SIEM, EDR/XDR, check connections related to suspicious IP addresses, and conduct additional scans of servers and computers operating via RDP.
If signs of compromise are detected in the system, it should be immediately disconnected from the network and the spread of the incident to other devices should be prevented.
UZCERT also requested that if signs of a cyber incident or unauthorized access to an information system are detected, the service should be promptly notified in accordance with established procedures.
