Cyber attacks increased by six times their usual levels between February and March 2020, driven by the COVID-19 pandemic and a sudden shift to remote work. Hacking and phishing attempts rose by 37% in one month, while the exposure of Remote Desktop Protocol (RDP) and VPN services grew significantly, creating new vulnerabilities for enterprises.
The rapid transition to remote work forced organizations to quickly expand their digital perimeters, leading to a surge in publicly accessible RDP and VPN infrastructure. This expansion inadvertently provided attackers with new entry points into corporate networks. Because RDP and VPNs are frequent targets for exploitation, this shift significantly heightened the risk of ransomware and other malicious activity. Securing these remote access tools and monitoring critical business systems like SAP are now essential components of modern enterprise defense.
Key Takeaways
- Cyber attacks increased by six times their usual levels during the initial four weeks of the COVID-19 pandemic.
- Hacking and phishing attempts rose by 37% between February and March 2020.
- The number of devices exposing RDP to the internet grew by up to 41.5% in March.
- VPN server usage increased by 33%, rising from 7.5 million to 10 million servers.
- RDP is a primary attack vector for ransomware, appearing in over 60% of campaigns.
What is the impact of remote work on RDP and VPN security?
The shift to remote work caused a dramatic increase in the number of servers using Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) services, creating significant new attack surfaces. In March 2020, devices exposing RDP to the internet on standard ports grew by 41.5%, while those on non-standard ports grew by 36.8%. Simultaneously, the number of servers running VPN protocols increased by 33%, growing from 7.5M to 10M.
Why is RDP a high-risk attack vector?
RDP is considered a high-risk vector because it has several known security weaknesses and is frequently used as an entry point for ransomware. It is the dominant vector in over 60% of ransomware campaigns. When RDP is publicly accessible without proper safeguards—such as network gateways, firewalls, and multi-factor authentication—it allows attackers to gain unauthorized access. Furthermore, vulnerabilities like Bluekeep (CVE-2019-0708) are “wormable,” enabling attackers to propagate malicious code to connected hosts while maintaining anonymity.
Are VPNs susceptible to cyber attacks?
Yes, VPNs are vulnerable to both client-side and server-side exploits that threat actors actively target. In October 2019, the National Security Agency (NSA) issued an advisory regarding vulnerabilities in products such as Pulse Secure, Palo Alto GlobalProtect, and Fortinet Fortigate. These flaws can be exploited to perform remote code execution or hijack encrypted sessions. Notably, VPN-related vulnerabilities were identified as the root cause of the Travelex cyber attack in January 2020.
How can enterprises secure SAP applications?
Enterprises can secure business-critical SAP applications by leveraging the Cybersecurity Extension for SAP Solution Manager, which automates vulnerability scanning and monitors event logs for indicators of compromise. By continuously monitoring these logs, organizations can detect malicious activity early. Interested parties can contact Layer Seven Security to learn how to better secure their SAP infrastructure against cyber threats.
Frequently Asked Questions
What was the primary driver for the surge in cyber attacks in early 2020?
The primary driver was the COVID-19 pandemic, which forced a global shift toward remote work. This transition caused organizations to rapidly deploy RDP and VPN services, often without sufficient security configurations, providing attackers with a new and expanded catalyst for hacking and phishing campaigns.
What specific RDP vulnerabilities should organizations be aware of?
Organizations should be aware of vulnerabilities like Bluekeep (CVE-2019-0708). These are considered “wormable,” meaning they allow malware to automatically propagate from one infected host to other connected systems within a network, significantly increasing the scale and speed of a potential compromise.
Which VPN products have been identified as targets for state-sponsored actors?
The NSA has issued advisories for several VPN products, including Pulse Secure, Palo Alto GlobalProtect, and Fortinet Fortigate. These products have been actively targeted by state-sponsored and other threat actors to perform remote code execution or to intercept encrypted traffic, as seen in high-profile attacks like the one on Travelex.