# MA-621.062016: MyCERT Alert - Possible Compromised RDP Servers Advertised on Underground Marketplace xDedic

**Date:** 27 Jun 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-621.062016  
**Advisory ID:** MA-621.062016

---

####
**1.0 Introduction**
MyCERT received information regarding IP addresses originating from worldwide with remote desktop protocol(RDP servers) may had been compromised which includes IP addresses originating from Malaysia.
The possibly compromised servers are loaded with certain softwares and being advertised in an underground marketplace called “xDedic” as shown in Figure 1 below. Base don the information we received, the possibly compromised servers belong to ordinary corporations, educational institutes and even government departments around the world. The marketplace let hackers trade the RDP server compromised by them at as low as US$6.
*Figure 1: xDedic marketplace*2.0 Impact**
A number of software was installed in the compromised servers for the buyers (who paid to take control of the compromised servers) to take benefits as listed in Table 1 below. Besides, the buyers might also be able to access any computer in the same network as that of the compromised server, which could mean that there might be a potential data leakage from other computers in the organization.
|  | --- | --- | **Software installed on compromised servers** | **Security impacts** | SCCLIENT Trojan and some other patches with registry modifications | Servers are controlled by the buyers to perform illegal activities such as fraudulent transactions, impersonating identity to login online services with stolen credentials, sending spam, or launching DDoS attack. | Brute force tools | Brute force and compromise more servers for sale | Bitcoin mining tool | Exhaust processing power | POS malware (on servers believed to be point-of-sale terminals) | Theft of financial data such as credit card information |
Table 1: List of softwares and its security impact.
**3.0 Recommendation**
1.    If you receive notification or detect that your server has been compromised for xDedic trading, please isolate it from the network immediately.
2.   Check for the presence of the following malwares:
a) SCCLIENT Trojan (/Windows/System32/scclient.exe), also registered as a service
b) xDedic Socks System (\AppData\Local\Temp\pxsrvc\pxsrvc.exe)
c) Tools such as DUBrute and XPC (detected as Hacktool.Win32.Bruteforce) for brute force attacking other servers
3.   Immediately change the password of all accounts used to login through RDP.
4.    Configure the account lockout settings to lock a user account after a period of time or a specified number of fail login attempts. This will prevent unlimited unauthorized attempts to login.
5.    Define a stringent password policy by configuring an expiration time and password length and complexity. This will reduce the time window for an attempted attack to succeed.
6.    Use firewall to restrict RDP servers to only authorized source IP addresses.
7.    Review and limit the administrative privileges through the built-in RDP RestrictedAdmin feature.
8.    Limit the number of users and machines that can log in using RDP.
9.    Add an extra layer of authentication, like two-factor authentication (2FA) for all remote access systems.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#f4978d969186cdcdcdb4978d96918687919781869d808dda998d) or [[email protected]](/cdn-cgi/l/email-protection#adc0d4cec8dfd9edc0d4cec8dfd983c2dfca83c0d4)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0 References**
•    <https://www.hkcert.org/my_url/en/blog/16062101>
•    <http://www.kaspersky.com/about/news/virus/2016/Who-Else-is-Using-your-Servers>