Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Section	Details
Threat Actors	- Midnight Blizzard (also known as APT29, UNC2452, Cozy Bear) - Attributed to the Foreign Intelligence Service of the Russian Federation (SVR)
Campaign Overview	- Since October 22, 2024, Midnight Blizzard has been conducting targeted spear-phishing attacks - Targets include individuals in government, academia, defense, NGOs, and other sectors - Emails contain signed RDP configuration files connecting to actor-controlled servers - Some emails impersonate Microsoft employees - Goal is likely intelligence collection
Target Regions	- Thousands of targets in over 100 organizations - Particularly in the United Kingdom, Europe, Australia, and Japan - Consistent with Midnight Blizzard’s usual targeting patterns
Methodology	- Spear-phishing emails with malicious .RDP attachments - Social engineering lures related to Microsoft, AWS, and Zero Trust - RDP files signed with Let’s Encrypt certificates - Establishes RDP connections to actor-controlled servers - Maps local resources to the remote server, enabling data exposure and potential malware installation
Product Targeted	- Windows systems utilizing Remote Desktop Protocol (RDP)
Malware Reference	- Malicious RDP configuration files - Previously known to use AD FS malware FOGGYWEB and MAGICWEB
Tools Used	- Spear-phishing emails - Signed RDP configuration files - Let’s Encrypt certificates - Possible use of FOGGYWEB and MAGICWEB malware
Vulnerabilities Exploited	- No specific vulnerabilities; relies on social engineering and misuse of RDP features
TTPs	- Spear-phishing with malicious attachments - Impersonation of trusted entities (e.g., Microsoft employees) - Use of signed RDP files to establish connections - Resource mapping for data exfiltration and malware installation - Use of compromised email addresses from previous attacks
Attribution	- Attributed to Midnight Blizzard (APT29, UNC2452, Cozy Bear) - Linked to the Russian SVR
Recommendations	- Restrict outbound RDP connections using Windows Firewall - Require multifactor authentication (preferably phishing-resistant methods) - Implement Conditional Access policies - Use browsers with Microsoft Defender SmartScreen - Enable tamper protection, network protection, and web protection in Microsoft Defender for Endpoint - Turn on cloud-delivered protection and real-time protection in antivirus software - Enable Safe Links and Safe Attachments in Office 365 - Educate users on phishing awareness
Source	- Microsoft Threat Intelligence report - Overlapping activity reported by CERT-UA (UAC-0215) and Amazon

 

Read More: https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/

Disclaimer: The above summary has been generated by an AI language model