Was this remotely exploitable with the firewall on (the default setting) and no user activity? Would love to learn more if you have any details or links - thank you.
Looks like I misread and this requires RDP to be enabled, which is not the default. But it was pretty common, Rob Graham counted almost one million hosts. https://blog.erratasec.com/2019/05/almost-one-million-vulner...