I had a similar incident at my home lab: - I had Windows Server 2016 with few Hyper-V VMs running - RDP was exposed to the Internet I remember I was working

I had a similar incident at my home lab: - I had Windows Server 2016 with few Hyper-V VMs running - RDP was exposed to the Internet I remember I was working on that computer, and the screen got locked, like someone pressed Win+L. So, I logged in and saw the folder on my desktop called, if remember correctly "Process Explorer 2" or something similar. The screen got locked on me again after a few seconds. I immediately realized the computer got infected. But after a few minutes, I had a very important meeting and only came back to investigate after about 3 hours. Results: - most of the files on the computer were encrypted. But files, which were in use (should I say "locked"?) - stayed. For example, VM disk images stayed unencrypted (but not metadata). That's how I saved one VM, which was somewhat important for me. - I had Synology NAS with btrfs connected via SMB to that Windows Server and few folders got encrypted. But because I have daily snapshots - I restored that in few minutes. After that incident, I reinstalled Windows Server (this time 2019) and started to pay more attention to the security, installed winlogbeats and found, that RDP is getting brute-forces at about 400 000 attempts / week from ~55 000 IPs. So, I installed fail2ban analog for Windows: https://github.com/DigitalRuby/IPBan https://github.com/DigitalRuby/IPBan and now I'm getting about 600 failed attempts/week Here is the screenshot of how the number of RDP attempts decreased after enabling IPBan: https://hsto.org/webt/oq/q1/ir/oqq1irnzeagwsqnbfpe4gbl9f_o.jpeg https://hsto.org/webt/oq/q1/ir/oqq1irnzeagwsqnbfpe4gbl9f_o.j...