Windows Remote Desktop Cache — The Hidden Screenshot Risk

Overview Recent research from SCYTHE Labs has revealed a subtle but serious exposure in Windows Remote Desktop Protocol (RDP). Every time a user connects via RDP, Windows quietly saves bitmap cache fragments of the session. These fragments can be stitched back together into readable screenshots — exposing sensitive data long after the session ends.

How the Risk Works

• Bitmap Cache: RDP stores small image tiles locally to improve performance.
• Persistence: These tiles remain on disk even after the session ends.
• Accessibility: Cache files sit in a standard user directory, requiring no admin privileges to access.
• Reconstruction: Attackers can parse and stitch tiles using free tools like bmc-tools and RdpCacheStitcher, recreating past session screens.

Why It Matters

• Sensitive Exposure: Cached tiles may reveal confidential documents, emails, credentials, or internal tools.
• Reconnaissance Value: Even partial reconstructions provide attackers with environmental details for lateral movement.
• Threat Actor Usage: Groups like BianLian, Medusa, and Scattered Spider exploit RDP extensively, making this cache a valuable intelligence source.
• Indicator of Compromise: An empty cache on a system with heavy RDP usage can signal attackers deliberately wiped evidence.

Defensive Guidance

Organizations should treat the RDP bitmap cache as a security liability and implement proactive defenses:

• Monitor Access: Flag unauthorized attempts to read or compress the cache folder.
• Detect Exfiltration: Alert on outbound HTTPS transfers of compressed archives from temp directories.
• PowerShell Monitoring: Catch compression commands targeting local app data paths.
• Disable Cache: Use Group Policy to turn off bitmap caching entirely.
• Incident Response: Add cache review checks to playbooks — investigate suspiciously missing cache files.

Final Thought

The RDP bitmap cache is a performance convenience turned security risk. Attackers don’t need advanced exploits — just free tools and patience — to reconstruct sensitive screenshots from cached fragments. For defenders, the lesson is clear: visibility, monitoring, and configuration hardening are essential to close this overlooked attack surface.