Russian spies use remote desktop protocol files in unusual mass phishing drive
Microsoft reported a mass phishing campaign by the Russian SVR's Midnight Blizzard group, targeting various organizations with RDP file attachments in emails, potentially exposing sensitive data and enabling malware installation.
Read original article
Microsoft has reported an ongoing mass phishing campaign attributed to the Russian intelligence agency SVR, specifically the Midnight Blizzard group. This campaign, which began on October 22, targets a wide range of organizations, including governments, NGOs, and academic institutions, using a novel technique involving remote desktop protocol (RDP) configuration files as attachments in phishing emails. Unlike their typical highly targeted approach, Midnight Blizzard has cast a broader net, sending emails to thousands across more than 100 organizations. The RDP files, if executed, establish a connection to a server controlled by the attackers, potentially exposing sensitive information and allowing for further malware installation. The emails were primarily in Ukrainian and aimed at organizations in the UK, Europe, Australia, and Japan, often impersonating Microsoft or other cloud service providers to enhance credibility. The campaign may have been in planning since at least August, and while the success rate of these attacks remains unclear, they align with Midnight Blizzard's history of targeting sensitive data for intelligence purposes. This incident follows previous breaches attributed to the same group, including a significant breach of Microsoft’s own systems earlier this year.
- Microsoft reports a mass phishing campaign by Russian spies using RDP files.
- The campaign targets a wide range of organizations, deviating from the group's usual tactics.
- Phishing emails impersonate Microsoft and other cloud providers to gain trust.
- The RDP files can expose sensitive information and facilitate malware installation.
- The campaign may have been planned since at least August 2024.
Related
Microsoft Alerts More Customers to Email Theft in Expanding
Microsoft alerts more customers about email theft post-Midnight Blizzard hack by Russian government. Stolen emails accessed, shared with affected organizations for transparency. Ongoing attack used for planning further attacks. Assistance provided to mitigate risks.
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
China-linked cyber-spies infect Russian govt, IT sector
Chinese cyber-spies compromised Russian government and IT systems using malware, including GrewApacha and CloudSorcerer, through phishing emails and cloud services, indicating collaboration among state-sponsored hacking groups.
Microsoft says more ransomware stopped before reaching encryption
Microsoft's Digital Defense Report reveals a 2.75 times increase in ransomware attacks, yet encryption incidents have decreased threefold. Social engineering remains a threat, with recommendations for multi-factor authentication and operational security.
Microsoft creates fake Azure tenants to pull phishers into honeypots
Microsoft is using realistic honeypot Azure tenants to attract and monitor phishing attackers, collecting intelligence on their methods to enhance cybersecurity and disrupt phishing campaigns effectively.
1 commentsRelated
Microsoft Alerts More Customers to Email Theft in Expanding
Microsoft alerts more customers about email theft post-Midnight Blizzard hack by Russian government. Stolen emails accessed, shared with affected organizations for transparency. Ongoing attack used for planning further attacks. Assistance provided to mitigate risks.
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
China-linked cyber-spies infect Russian govt, IT sector
Chinese cyber-spies compromised Russian government and IT systems using malware, including GrewApacha and CloudSorcerer, through phishing emails and cloud services, indicating collaboration among state-sponsored hacking groups.
Microsoft says more ransomware stopped before reaching encryption
Microsoft's Digital Defense Report reveals a 2.75 times increase in ransomware attacks, yet encryption incidents have decreased threefold. Social engineering remains a threat, with recommendations for multi-factor authentication and operational security.
Microsoft creates fake Azure tenants to pull phishers into honeypots
Microsoft is using realistic honeypot Azure tenants to attract and monitor phishing attackers, collecting intelligence on their methods to enhance cybersecurity and disrupt phishing campaigns effectively.