What is the MOST common cause of Remote Desktop Protocol (RDP) compromise?

A port scan is a reconnaissance technique used to discover open ports and services, not a method to directly compromise RDP - it may precede an attack but is not itself an attack.

Brute force attacks are the most prevalent RDP attack vector because RDP is frequently exposed directly to the internet on port 3389 with weak or default credentials, making automated credential stuffing and password spraying highly effective. Threat intelligence consistently identifies brute force as the leading initial access method for RDP compromise, often leading to ransomware deployment or unauthorized remote access.

Remote exploits targeting RDP vulnerabilities (e.g., BlueKeep/CVE-2019-0708) do exist but are far less common than brute force attacks because they require unpatched systems and more sophisticated exploitation techniques.

Social engineering manipulates users psychologically to divulge credentials or grant access, but it is not the most common direct method used to compromise RDP services specifically.