Microsoft recently revealed that Russian hackers, known as Midnight Blizzard, have been targeting government workers in a sophisticated information-stealing campaign. These hackers have been using a tool to gain full access to victims’ devices through highly targeted spear-phishing emails. The emails contain Remote Desktop Protocol (RDP) configuration files that, when opened, allow the hackers to connect to the victim’s device and gain access to sensitive information.
The campaign, which has been ongoing since October 22, has targeted individuals in government, academia, defense, non-governmental organizations, and other sectors. Microsoft has observed thousands of targets in over 100 organizations receiving these malicious emails. Once a victim’s system is compromised, the hackers can install malware, map the victim’s network, and access credentials.
What makes this campaign particularly concerning is the use of RDP configuration files, a new tactic employed by Midnight Blizzard. This advancement in their tactics has been noted by both Amazon and the Government Computer Emergency Response Team of Ukraine. The hackers have also targeted individuals in various countries, including the United Kingdom, Europe, Australia, and Japan.
In a separate incident, Amazon warned of a phishing campaign by Russia’s Foreign Intelligence Service, targeting government agencies, companies, and militaries. The hackers, known as APT29, used Ukrainian language phishing emails to steal Windows credentials through Microsoft Remote Desktop. Upon learning of this activity, Amazon took action to seize the domains being abused by APT29.
It is worth noting that SVR hackers were responsible for a major breach of Microsoft systems last November, which also exposed emails from several U.S. federal agencies. In addition to recent attacks on software companies like TeamViewer, the SVR has been involved in significant cyberattacks in U.S. history, including the SolarWinds hack in 2020 and the 2016 attack on the Democratic National Committee.
These incidents underscore the ongoing threat posed by sophisticated hacking groups backed by nation-states. As organizations and individuals continue to be targeted in cyberattacks, it is crucial to remain vigilant and implement robust security measures to protect against such threats. Collaboration between cybersecurity experts, government agencies, and technology companies is essential in addressing and mitigating the risks posed by these malicious actors.