THREATOPS
THREAT OPS › Threat News › 100,000+ IP Botnet Launches Coordinated RDP Attack Wave Against US Infrastructure

100,000+ IP Botnet Launches Coordinated RDP Attack Wave Against US Infrastructure

infogreynoise_blogPublished 2025-10-10

Since October 8, 2025, GreyNoise has tracked a coordinated botnet operation involving over 100,000 unique IP addresses from more than 100 countries targeting Remote Desktop Protocol (RDP) services in the United States.

MITRE ATT&CK techniques

Original source: https://www.greynoise.io/blog/botnet-launches-coordinated-rdp-attack-wave