Ankura CTIX FLASH Update - December 20, 2024

Malware Activity

Midnight Blizzard Uses RDP Proxies for MiTM Attacks

Researchers have discovered 193 remote desktop protocol (RDP) proxy servers provisioned as part of a malicious attack likely orchestrated by the Russian threat actor Midnight Blizzard (APT 29). The attacks are spear-phishing campaigns targeting government and military organizations, IT providers, telecommunications, and cybersecurity companies in countries such as the U.S., France, Australia, Ukraine, Israel, and Germany. The goal of the campaign is to lure victims into running a malicious RDP configuration file, which when opened instructs the victim to connect to an RDP server with a legitimate looking hostname. In order to minimize suspicious warnings and the need for user interactions common with RDP sessions, the attacks use a man-in-the-middle (MiTM) proxy in front of the rogue RDP servers using the Python Remote Desktop Protocol MitM tool PyRDP. The setup enables the attacker to pose as