{"id":6666,"date":"2024-12-18T08:17:28","date_gmt":"2024-12-18T14:17:28","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/midnight-blizzard-taps-phishing-email-rogue-rdp-nets"},"modified":"2024-12-18T08:17:28","modified_gmt":"2024-12-18T14:17:28","slug":"midnight-blizzard-taps-phishing-emails-rogue-rdp-nets","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/12\/18\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets\/","title":{"rendered":"Midnight Blizzard Taps Phishing Emails, Rogue RDP Nets"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

An ongoing cyber-espionage campaign by Russia’s Midnight Blizzard threat group may be much larger in scope than generally assumed, targeting international entities in government, armed forces, and academic institutions, Trend Micro said in recently released research.<\/span><\/p>\n

At its peak in October, Trend Micro researchers observed Midnight Blizzard \u2014 which they track as Earth Koshchei \u2014 hitting as many as 200 entities a day with phishing emails containing a malicious Remote Desktop Protocol (RDP) file and red-team testing tools to take control of victim systems and steal data or plant malware on them. That volume is roughly what other groups with similar capabilities to \u2014 such as <\/span>Pawn Storm<\/a><\/span> \u2014 typically target over multiple weeks, Trend Micro said in a <\/span>report this week<\/a><\/span>.<\/span><\/p>\n

In these attacks, intended victims received tailored spear-phishing emails containing a malicious or rogue RDP configuration file that, if used, would direct the victim’s system to a remote attacker-controlled system. RDP configuration files simplify and automate remote access to enterprise systems by storing settings \u2014 such as a target computer’s address and connection preferences \u2014 to enable remote desktop connections.<\/span><\/p>\n

Trend Micro found the threat actor using the open source PyRDP tool as a sort of adversart-in-the-middle proxy to redirect connection requests from victim systems to attacker-controlled domains and servers. “The attack technique is called ‘rogue RDP,’ which involves an RDP relay, a rogue RDP server, and a malicious RDP configuration file,” the researchers explained. “A victim of this technique would give partial control of their machine to the attacker, potentially leading to data leakage and malware installation.”<\/span><\/p>\n

Careful Planning<\/h2>\n

In August, Midnight Blizzard began setting up what would eventually be more than 200 domain names to direct victims to as part of the attack chain. Trend Micro also observed the attacker using 34 rogue RDP backend servers as part of its sprawling infrastructure.<\/span><\/p>\n

The domain names that the threat actor used suggested government and military targets in the US, Europe, Japan, Australia, and Ukraine. Intended victims included ministries of foreign affairs, academic researchers, and military entities.  “The scale of the RDP campaign was huge,” Trend Micro found.<\/span><\/p>\n

Midnight Blizzard is a cyber-espionage group that the US government has identified as working for on or behalf of Russia’s foreign intelligence service. The group is tied to numerous well known breach incidents, including ones at <\/span>Microsoft<\/a><\/span>, <\/span>SolarWinds<\/a><\/span>, <\/span>HPE<\/a><\/span>, and multiple <\/span>US federal government agencies<\/a><\/span>. Its campaigns typically involve sophisticated spear-phishing emails, stolen credentials, and supply chain attacks to gain initial access to target systems. It is also known to target vulnerabilities in widely used networking and collaboration tools from vendors such as Pulse Secure Citrix, Zimbra, and Fortinet.<\/span><\/p>\n

The group has also has a penchant for using legitimate pen testing and red-team tools to evade detection by endpoint security controls. In the current campaign. Midnight Blizzard’s use of legitimate tools like RDP and PyRDP has allowed the threat actor to operate largely under the radar on compromised networks. In addition, the threat actors often have a tendency to tap resident proxy services, Tor, and VPNs as anonymization layers while it operates in stealth on compromised networks.<\/span><\/p>\n

“Notably no malware is installed on the victim’s machines per se. Instead, a malicious configuration file with dangerous settings facilitates this attack, making it a stealthier living-off-the-land operation that is likely to evade detection,” according to Trend Micro’s report.<\/span><\/p>\n

The security vendor wants organizations that don’t block outbound RDP connection requests to begin doing so straight away. They also recommend blocking RDP configuration files in email.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

An ongoing cyber-espionage campaign by Russia’s Midnight Blizzard threat group<\/p>\n","protected":false},"author":12,"featured_media":6667,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/midnight-blizzard-taps-phishing-emails-rogue-rdp-nets.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6666"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6666\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6667"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}