Morto Worm spreading via Remote Desktop Protocol. F-Secure reports that the worm is behind a spike in traffic on Port 3389/TCP. Vulnerable machines get Morto copied to their local drives as a DLL, a.dll, which creates other files detailed in the post. The emergence of this worm correlates with the increased volumes of. TCP port 3389 traffic, reported by SANS Internet Storm Center a few days prior to the report: The propagation approach employed by “” is often used by penetration testers and human attackers alike: access the remote host by brute-force.
Source: https://thehackernews.com/2011/08/morto-worm-spreading-via-remote-desktop.html