15.6 Million Exposed RDP Endpoints: Why Remote Desktop Remains the Favourite Initial Access Vector
A ZoomEye query for port="3389" && service="rdp" returns 15,655,618 matching assets. Remote Desktop Protocol is the single most exposed interactive administration service on the internet, and it is also one of the most frequently used entry points in ransomware incidents. The two facts are related.
The problem
RDP provides graphical access to a Windows host. Exposing it to the internet means offering an interactive login prompt to every address on the network, and interactive login prompts can be attacked with credentials rather than exploits. That changes the economics of intrusion: an attacker does not need a vulnerability, only a valid username and password combination. Credentials are obtained through phishing, infostealer malware, credential reuse from unrelated breaches, or brute force against accounts without lockout.
How the measurement was taken
The figure comes from a single ZoomEye query executed on 2026-09-16:
- Search dork:
port="3389" && service="rdp" - Scope:
sub_type=all - Result: 15,655,618 matching assets This query combines a port and a service fingerprint, which is more specific than a port-only query. It identifies services where ZoomEye observed the RDP protocol on the standard port. It does not indicate whether network-level authentication is enforced, whether the host is patched, or whether the endpoint is a honeypot. Many of these endpoints are legitimate remote access services that are correctly configured with multi-factor authentication and network restrictions. The number measures the size of the attack surface, not the number of vulnerable hosts. ## Why RDP exposure is different from other exposed services Several properties make RDP a distinctive risk.
- It is an authentication surface, not just a service. Every exposed endpoint accepts credential attempts. Whether those attempts are rate-limited, locked out and logged determines whether the exposure is manageable.
- It grants interactive control. A successful login is not a foothold; it is a desktop. From there, an attacker can disable defences, install tooling and move laterally using the victim's own credentials.
- It is heavily targeted by commodity tooling. Automated scanners and credential-stuffing tools target 3389 continuously. Exposure is not a passive risk; it is an active one.
- It frequently bypasses other controls. A host exposed on 3389 may sit outside the VPN and outside the network monitoring that covers the corporate estate, which is often why it was exposed in the first place. ## The realistic risk in this population The exposure number is not the same as the number of compromised hosts, and the difference lies in configuration. Endpoints with network-level authentication, account lockout, multi-factor authentication and source address restrictions are exposed but defended. Endpoints with a local administrator account and no lockout policy are exposed and undefended. The measurement cannot distinguish them, which is exactly why defenders should not reason from the global number and instead should enumerate their own 3389 listeners. ## Practical next steps for defenders Enumerate your own exposure. Query your address space for the same fingerprint and compare the result against the asset inventory. Any host that appears in the scan but not in the inventory is the priority finding. Put RDP behind something. A VPN, a zero-trust access broker or an RD Gateway converts a public login prompt into an authenticated, logged session. This is the highest-value change and it is usually the least disruptive. Require multi-factor authentication. For RDP specifically, this removes the value of a stolen password. Where native support is limited, a broker or gateway can enforce it. Enable network-level authentication. NLA requires authentication before a session is established, which reduces the pre-authentication attack surface. Enforce account lockout and monitor for it. Lockout converts brute force into a detectable event. Alert on repeated failures and on successful logins from new source addresses. Patch the service, not just the operating system. RDP has had remote code execution vulnerabilities, including pre-authentication ones. Patch cadence for exposed hosts should be shorter than for internal ones. Assume credential compromise is the primary path. Detection should focus on successful authentication from unexpected locations, on new account creation, and on the disabling of security tooling shortly after a login. ## Limitations A combined port and service fingerprint is more precise than a port-only query but still cannot confirm the authentication configuration of any specific host. ZoomEye observes the service from outside; it cannot see whether NLA is enforced or whether MFA is required. The 15,655,618 figure should be read as a measure of how much interactive Windows access is offered to the internet, and the appropriate response is to reduce that number for your own estate rather than to interpret it as a count of compromised systems. ## References
- Microsoft documentation, "Remote Desktop Services security": https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/security
- Microsoft documentation, "Network Level Authentication": https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients
- CISA and NSA, "Defending Against RDP Attacks": https://www.cisa.gov/news-events/cybersecurity-advisories
- ZoomEye search interface: https://www.zoomeye.ai/
