{
  "family": "rpdpatch",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nRPDPatch (or RDP Patcher) is a classification for tools, often flagged as HackTools or Riskware, designed to circumvent Microsoft Windows licensing restrictions. Standard Windows client operating systems (like Windows 10/11 Pro) only allow a single, concurrent Remote Desktop Protocol (RDP) session. RPDPatch alters system DLLs (specifically `termsrv.dll`) to allow multiple, simultaneous RDP connections to a single client machine. While sometimes used legitimately by aggressive IT administrators, threat actors heavily abuse this tool to establish persistent, interactive remote access to compromised systems without interrupting the legitimate user's session.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nRPDPatch is a post-exploitation tool. It is manually deployed and executed by an attacker who has already breached the endpoint, escalated privileges to Administrator or SYSTEM, and wishes to solidify their backdoor access.\n\nUpon execution, RPDPatch modifies core OS components:\n<ul>\n<li><strong>DLL Patching (`termsrv.dll`):</strong> The tool forcibly modifies the binary code of the Terminal Services DLL (`termsrv.dll`) in the `System32` directory. It patches the specific conditional jumps that enforce the single-session connection limit, effectively unlocking Windows Server-like terminal services on a client OS.</li>\n<li><strong>Service Restart:</strong> After patching the DLL, the tool restarts the Remote Desktop Services (`TermService`) to apply the changes.</li>\n<li><strong>Covert Access:</strong> Once patched, the attacker can connect via RDP to the compromised machine at any time, using a stolen credential or a newly created hidden admin account, without kicking the legitimate user off the computer. This allows for highly stealthy, interactive lateral movement.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized detection of an RPDPatch is a critical indicator of a severe, ongoing compromise. It signifies that an attacker has gained complete administrative control over the endpoint, is actively establishing persistent backdoors, and is likely using the machine as a pivot point to attack the rest of the network via RDP.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the endpoint immediately to terminate the attacker's active RDP session and prevent further lateral movement.</li>\n<li><strong>Forensic Investigation of User Accounts:</strong> Analysts must immediately investigate the local SAM database and Active Directory logs to identify which accounts the attacker used to authenticate via the patched RDP service, and look for any newly created, hidden administrator accounts.</li>\n<li><strong>Total Re-imaging:</strong> Because the attacker had interactive SYSTEM-level access and actively modified core Windows DLLs, attempting to manually revert the `termsrv.dll` patch is insufficient. The endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.RPDPatch",
    "Riskware.RDPPatcher",
    "Tool.RDPWrap",
    "Win32/Patch.RDP"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1563.002",
    "T1021.001",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:23:02Z",
  "type": "HackTool / Riskware (RDP Modification)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}