Researchers used Vectra’s Cognito platform to analyse network traffic between January and June 2019, and found that 26,800 suspicious RDP behaviours had been detected in more than 350 deployments.