Remote accessTCP/UDP 3389 Encrypted
Port 3389: RDP
Remote Desktop Protocol
Graphical remote access to Windows.
How attackers abuse it
- One of the most common ransomware entry points when exposed to the internet.
- Brute forcing and credential stuffing.
- Wormable flaws such as BlueKeep in unpatched systems.
How to defend it
- Never expose RDP directly; use a VPN or gateway with MFA.
- Enable Network Level Authentication and account lockout.
- Restrict and monitor who can log on remotely.
Exam tip
Exposed RDP plus weak passwords is a recurring root cause in ransomware case studies.