Midnight Blizzard hacking group hijacks RDP proxies to launch malware assaults

Development Micro spots subtle spear-phishing marketing campaign focusing on navy and authorities targets
It makes use of nearly 200 RDP proxies to achieve entry to endpoints
The entire variety of victims is within the tons of

AN superior persistent menace, often known as Midnight Blizzard, HAS launched a large-scale spear phishing assault that focused governments, navy organizations, and tutorial researchers within the West.

The group exploited purple workforce methodologies and anonymization tools, because it exfiltrated delicate information from their goal’s IT infrastructure, cybersecurity researchers from Development Micro has revealed.

In a report, the researchers stated the group utilized a rogue Remote Desktop Protocol (RDP) and a Python-based software referred to as PyRDP. The assault begins with a spear-phishing e mail carrying a malicious RDP configuration file. If the sufferer runs it, it connects to an attacker-controlled RDP server.

On Russia’s payroll

The marketing campaign used 34 rogue RDP backend servers together with 193 proxy servers to redirect sufferer connections and masks the attackers’ actions.

As soon as the sufferer is related, the crooks use PyRDP to intercept the connection, performing as a man-in-the-middle (MitM). Then, with entry to focus on endpoints, the attackers might browse recordsdata, exfiltrate delicate information, and extra.

Whereas the overall variety of victims throughout all the marketing campaign is unclear, Development Micro says that roughly 200 high-profile victims had been focused in a single day, when the marketing campaign was at its peak, in late October 2024.

The victims had been authorities and navy organizations, assume tanks and tutorial researchers, entities associated to the Ukrainian authorities, a cloud service supplier, and entities related to the Netherlands’ Ministry of Overseas Affairs.

Most of them are situated in Europe, the US, Japan, Ukraine, and Australia.

To place issues into extra context, it’s value noting that Midnight Blizzard is also referred to as APT29, Earth Koschchei, or Cozy Bear. It’s a classy superior persistent menace group sponsored by the Russian authorities and below direct management of the Russian Overseas Intelligence Service (SVR). It’s recognized for conducting cyber-espionage campaigns primarily in Western international locations.

By way of BleepingComputer