Midnight Blizzard hacking group hijacks RDP proxies to launch malware attacks

News
By
published

Almost 200 servers were used in a sophisticated cyber-espionage campaign

A red padlock image against a digital map of the earth in blue.
(Image credit: Shutterstock / Askobol)
  • Trend Micro spots sophisticated spear-phishing campaign targeting military and government targets
  • It uses almost 200 RDP proxies to gain access to endpoints
  • The total number of victims is in the hundreds

AN advanced persistent threat, known as Midnight Blizzard, HAS launched a large-scale spear phishing attack that targeted governments, military organizations, and academic researchers in the West.

The group exploited red team methodologies and anonymization tools, as it exfiltrated sensitive data from their target’s IT infrastructure, cybersecurity researchers from Trend Micro has revealed.

In a report, the researchers said the group utilized a rogue Remote Desktop Protocol (RDP) and a Python-based tool called PyRDP. The attack starts with a spear-phishing email carrying a malicious RDP configuration file. If the victim runs it, it connects to an attacker-controlled RDP server.

On Russia's payroll

The campaign used 34 rogue RDP backend servers in combination with 193 proxy servers to redirect victim connections and mask the attackers' activities.

Once the victim is connected, the crooks use PyRDP to intercept the connection, acting as a man-in-the-middle (MitM). Then, with access to target endpoints, the attackers could browse files, exfiltrate sensitive data, and more.

While the total number of victims across the entire campaign is unclear, Trend Micro says that approximately 200 high-profile victims were targeted in a single day, when the campaign was at its peak, in late October 2024.

The victims were government and military organizations, think tanks and academic researchers, entities related to the Ukrainian government, a cloud service provider, and entities associated with the Netherlands’ Ministry of Foreign Affairs.

Most of them are located in Europe, the United States, Japan, Ukraine, and Australia.

To put things into more context, it’s worth noting that Midnight Blizzard is also known as APT29, Earth Koschchei, or Cozy Bear. It’s a sophisticated advanced persistent threat group sponsored by the Russian government and under direct control of the Russian Foreign Intelligence Service (SVR). It is known for conducting cyber-espionage campaigns primarily in Western countries.

Via BleepingComputer

You might also like

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.