Midnight Blizzard hacking group hijacks RDP proxies to launch malware attacks

A red padlock image against a digital map of the earth in blue.

(Image credit: Shutterstock / Askobol)

Trend Micro spots sophisticated spear-phishing campaign targeting military and government targets
It uses almost 200 RDP proxies to gain access to endpoints
The total number of victims is in the hundreds

AN advanced persistent threat, known as Midnight Blizzard, HAS launched a large-scale spear phishing attack that targeted governments, military organizations, and academic researchers in the West.

The group exploited red team methodologies and anonymization tools, as it exfiltrated sensitive data from their target’s IT infrastructure, cybersecurity researchers from Trend Micro has revealed.

In a report, the researchers said the group utilized a rogue Remote Desktop Protocol (RDP) and a Python-based tool called PyRDP. The attack starts with a spear-phishing email carrying a malicious RDP configuration file. If the victim runs it, it connects to an attacker-controlled RDP server.

On Russia's payroll

The campaign used 34 rogue RDP backend servers in combination with 193 proxy servers to redirect victim connections and mask the attackers' activities.

Once the victim is connected, the crooks use PyRDP to intercept the connection, acting as a man-in-the-middle (MitM). Then, with access to target endpoints, the attackers could browse files, exfiltrate sensitive data, and more.

While the total number of victims across the entire campaign is unclear, Trend Micro says that approximately 200 high-profile victims were targeted in a single day, when the campaign was at its peak, in late October 2024.

The victims were government and military organizations, think tanks and academic researchers, entities related to the Ukrainian government, a cloud service provider, and entities associated with the Netherlands’ Ministry of Foreign Affairs.

Most of them are located in Europe, the United States, Japan, Ukraine, and Australia.

To put things into more context, it’s worth noting that Midnight Blizzard is also known as APT29, Earth Koschchei, or Cozy Bear. It’s a sophisticated advanced persistent threat group sponsored by the Russian government and under direct control of the Russian Foreign Intelligence Service (SVR). It is known for conducting cyber-espionage campaigns primarily in Western countries.

Via BleepingComputer

Hundreds of malware-laden fake npm packages posted online to try and trick developers
Here's a list of the best antivirus
These are the best endpoint protection tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.