One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the account lockout policy was not set).
I looked at the windows event logs and found their bruteforce tries, it got so many login failed entries, that I only have logs for the last few days before the attack. They managed to find the password of a user who set it to something really easy to bruteforce. One of the things I noticed that they seem to knew our usernames and I wonder how. They tried a bunch of random names too, but most of the tries were for existing usernames (I exported the names to a text file and made a report from it, counting each try for each name. Almost 90% of the tries went to existing usernames).
How is that possible? I read the answer here, but our server is a Windows Server 2016. I ran two scripts made for taking remote desktop screenshots and could not connect. One of them mentioned that NLA is enabled on the server.