Crysis Ransomware Employing RDP Brute-Force Attacks in New Campaign

Security researchers say they've discovered a new Crysis ransomware distribution campaign that uses RDP brute-force attacks to compromise the computers of businesses in Australia and New Zealand.

Crooks are scanning the Internet for unsecured, open RDP ports, and are launching brute-force attacks in an attempt to guess the exposed computer's admin password.

If they do, the crooks install the Crysis ransomware on that specific station, but where possible, they also spread it to other computers on the same network, either by brute-forcing nearby PCs, or by leaving Crysis payloads on other network devices, such as printers or routers, which then spread it to other users.

These campaigns have only been seen in Australia and New Zealand, according to Trend Micro researchers.

Crysis wanted to replace TeslaCrypt but...