One of the big attack trends we've seen in 2017 has been a focus on infiltrating organizations through publicly accessible Remote Desktop Protocol (RDP) services. The tactic has been especially popular for spreading ransomware, with the criminal groups behind such variants as SamSam, CrySiS, Shade, Apocalypse, BTCWare, and others all getting in on the act.
Article Link: https://blog.barkly.com/new-ransomware-hc7-spreads-via-legitimate-admin-tools