Security experts warn that weak Remote Desktop Protocol Credentials are in wide circulation on darknet marketplaces and increasingly used by ransomware attackers. Darknet markets sell Harvested RDP credentials for as little as $3 per person on UAS darknet markets. Attackers often use botnets to search out internet-connected devices with exposed RDP ports and them hammer them with brute-force username and password guesses until their attack tools find a match. Many RDP credential harvesters will then sell this access to others.”]
Source: https://www.databreachtoday.com/hackers-exploit-weak-remote-desktop-protocol-credentials-a-10433