The Attacker’s Dictionary

05
COLLECTED CREDENTIALS
We have collected credentials intended for our RDP listening services over
the past 334 days, from 2015-03-12 to 2016-02-09. Over this period, we
have recorded 221,203 attempts to login, sourced from 119 countries
(Figures 5 and 6).
While we have primarily focused on the interesting features of the passwords,
our Heisenberg network has also collected usernames. Because of
this, we have access to the complete credentials, which can be critical in
identifying the intended target.
Figure 5: Credentials collected worldwide
| Rapid7.com The Attacker’s Dictionary: Auditing Criminal Credential Attacks 10