Instead of looking for brute-forcing tools, organizations should focus on hardening their own RDP defenses: Disable RDP if Not Needed: