CISA Warns of Ongoing Spear Phishing Campaign Using RDP Attachments
A foreign threat actor tracked by Microsoft as Midnight Blizzard (aka APT29, Cozy Bear) is conducting a spear phishing campaign targeting organizations in multiple sectors, including government, defense, academia, non-governmental organizations (NGOs), information technology, and other sectors.
Midnight Blizzard is a suspected Russian state-sponsored hacking group that conducts attacks in support of Russia’s Foreign Intelligence Service (SVR). The group is known to use diverse tactics in its espionage operations including bespoke malware and publicly available tools such as Mimikatz and Cobalt Strike.
Its current campaign, which has been active since at least October 22, 2024, has involved thousands of spear phishing emails to individuals at more than 100 organizations worldwide. The threat actor poses as a trusted entity, including Microsoft and Amazon Web Services (AWS), and sends emails with a signed remote desktop protocol (RDP) file attachment. The attached RDP configuration file establishes a connection with a server under Midnight Blizzard’s control.
According to Microsoft, through the established connection, the threat actor can receive resources such as “logical hard disks, clipboard contents, printers, connected peripheral devices, audio, and authentication features and facilities of the Windows operating system, including smart cards.” The threat actor could use the connection to install malware onto victims’ local drives and mapped network shares, ensuring persistent access when the RDP session is closed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about the group after receiving multiple reports of spear phishing attacks and has recommended several mitigations. These include restricting outbound RDP connections, blocking RDP connections in communication platforms such as email clients and webmail services, implementing controls to block RDP files by users, deploying endpoint detection software, providing security awareness training to the workforce, and enabling multifactor authentication (MFA) to add an extra layer of security to remote access, and ideally phishing-resistant MFA as SMS based-MFA is vulnerable to phishing and SIM-jacking attacks.
