JIGSAW RDPUZZLE: PIECING ATTACKER ACTIONS TOGETHER

Summary from the TLDR InfoSec newsletter

German IT firm ERNW observed that an attacker compromised a customer who acted as a service provider that used RDP to connect to its customers' machines. ERNW extracted the Bitmap cache files from the RDP server to partially reconstruct the attacker's RDP sessions utilizing open-source tools. The post features screenshots displaying some of the images that ERNW managed to reconstruct.