Suddenly RDP to several 2008R2 terminal servers is intermittent, anyone else?

https://www.reddit.com/r/sysadmin/comments/dqq9pl/rdp_worm_out_in_the_wild/

Maybe related to this?

We've been dealing with that since last thursday. I've posted this to another thread:

"We (possibly) had the same issue: this morning 3 different clients with each their own 2008R2 TS on different locations reporting not being able to connect to the TS. AFAIK this started about 3 hours ago. I checked the servers but saw nothing amiss, checked clients, suspecting a Windows Update, but nothing there either. Even called the ISP of two clients (same ISP) to check if they made changes or something, but nothing. And then about half an hour ago, it's all working again."

and today

"In an attempt to figure out what is going on, I've narrowed it down to this issue being a combination of Windows 10 1903 (not fully sure, but we do have a few mac users, who are not affected by this) with Windows 2008R2 server.

Looking in the Security eventlog (example), I notice a massive amount of audit failures. Notable here is the originating workstation name frequently is "Remmina" (linux rdp client) or "Freerdp". In one series of logon failures, there was an originating IP, which (seemingly) is Ukraine based.
Account names used are "Administrator, "admin", "administrateur", "administrador" and similar common accounts.
My guess is, there's a wave of RDP hacking attempts going on, which overloads the TS, preventing genuine users to login.

Putting this to the test by IP-restricting RDP connections for some clients."

That worm is consistent with what we see in the security logs. So, yes, that could be an explanation.

Yeah, I've just run into this. Someone had pointed me to the Bluekeep vulnerability however some of the impacted machines are updated and kept frequently updated so I don't think that's the case.

They are on VMware ESXi as well, however different host hardware.

Might be related to Bluekeep worm, servers were getting hammered with requests(security logs showed failed logins) I monitored firewall logs for a few moments, had a bunch of requests coming in from Amazonaws and blocked those ranges in the firewall. There's still requests coming in but way less than before and logging in went smoother.

We had the same thing happen and our servers were getting pounded with failed login requests. Not sure if it's just a large botnet trying to exploit bluekeep or what but it was definitely a real problem.

Similar topic: https://old.reddit.com/r/sysadmin/comments/drg0g8/server_2008_r2_rdp_server_replies_ackrst_to_most/

Also if anyone affected can post NLA requirement, protocol and security levels for the affected machines?

We just had this on Friday. It was a simple DDOS. We forced NLA and the issues went away. NLA had been turned on previous and showed as being on, but we had to switch it off, save, and then switch it back on before it stopped.