Since September 2016, a criminal group has been using different versions of the Crysis ransomware to infect enterprise networks where they previously gained access to by brute-forcing workstations with open RDP ports. Trend Micro says incidents more than doubled in January 2017, compared to previous months. The group has slowly expanded to new territories and has also started to target larger enterprises as well as healthcare organizations in the US. In one specific case, Trend Micro reported seeing the group install six different Crysis versions in the span of only ten minutes.
Source: https://www.bleepingcomputer.com/news/security/number-of-rdp-brute-force-attacks-spreading-crysis-ransomware-doubles-in-6-months/