{"id":136186,"date":"2024-10-29T12:00:00","date_gmt":"2024-10-29T19:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=136186"},"modified":"2024-11-08T07:06:14","modified_gmt":"2024-11-08T15:06:14","slug":"midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/10\/29\/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files\/","title":{"rendered":"Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files"},"content":{"rendered":"\n

Since October 22, 2024, Microsoft Threat Intelligence has observed Russian threat actor Midnight Blizzard sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. This activity is ongoing, and Microsoft will continue to investigate and provide updates as available. Based on our investigation of previous Midnight Blizzard spear-phishing campaigns, we assess that the goal of this operation is likely intelligence collection. Microsoft is releasing this blog to notify the public and disrupt this threat actor activity. This blog provides context on these external spear-phishing attempts, which are common attack techniques and do not represent any new compromise of Microsoft.<\/p>\n\n\n\n

The spear-phishing emails in this campaign were sent to thousands of targets in over 100 organizations and contained a signed Remote Desktop Protocol (RDP) configuration file that connected to an actor-controlled server. In some of the lures, the actor attempted to add credibility to their malicious messages by impersonating Microsoft employees. The threat actor also referenced other cloud providers in the phishing lures. <\/p>\n\n\n\n

While this campaign focuses on many of Midnight Blizzard\u2019s usual targets, the use of a signed RDP configuration file to gain access to the targets\u2019 devices represents a novel access vector for this actor. Overlapping activity has <\/a>also been reported by the Government Computer Emergency Response Team of Ukraine (CERT-UA) under the designation UAC-0215<\/a> and also by Amazon<\/a>.<\/p>\n\n\n\n

Midnight Blizzard<\/a> is a Russian threat actor attributed by the United States<\/a> and United Kingdom governments to the Foreign Intelligence Service of the Russian Federation, also known as the SVR. This threat actor is known to primarily target governments, diplomatic entities, non-governmental organizations (NGOs), and IT service providers, primarily in the United States and Europe. Its focus is to collect intelligence through longstanding and dedicated espionage of foreign interests that can be traced to early 2018. Its operations often involve compromise of valid accounts and, in some highly targeted cases, advanced techniques to compromise authentication mechanisms within an organization to expand access and evade detection.<\/p>\n\n\n\n

Midnight Blizzard is consistent and persistent in its operational targeting, and its objectives rarely change. It uses diverse initial access methods, including spear phishing, stolen credentials, supply chain attacks, compromise of on-premises environments to laterally move to the cloud, and leveraging service providers\u2019 trust chain to gain access to downstream customers. Midnight Blizzard is known to use the Active Directory Federation Service (AD FS) malware known as FOGGYWEB<\/a> and MAGICWEB<\/a>. Midnight Blizzard is identified by peer security vendors as APT29, UNC2452, and Cozy Bear.<\/p>\n\n\n\n

As with any observed nation-state actor activity, Microsoft is in the process of directly notifying customers that have been targeted or compromised, providing them with the necessary information to secure their accounts. Strong anti-phishing measures will help to mitigate this threat. As part of our commitment to helping protect against cyber threats, we provide indicators of compromise (IOCs), hunting queries, detection details, and recommendations at the end of this post.<\/p>\n\n\n\n

Spear-phishing campaign<\/h2>\n\n\n\n

On October 22, 2024, Microsoft identified a spear-phishing campaign in which Midnight Blizzard sent phishing emails to thousands of users in over 100 organizations. The emails were highly targeted, using social engineering lures relating to Microsoft, Amazon Web Services (AWS), and the concept of Zero Trust. The emails contained a Remote Desktop Protocol (RDP) configuration file signed with a LetsEncrypt certificate. RDP configuration (.RDP) files summarize automatic settings and resource mappings that are established when a successful connection to an RDP server occurs. These configurations extend features and resources of the local system to a remote server, controlled by the actor.<\/p>\n\n\n\n

In this campaign, the malicious .RDP attachment contained several sensitive settings that would lead to significant information exposure. Once the target system was compromised, it connected to the actor-controlled server and bidirectionally mapped the targeted user\u2019s local device\u2019s resources to the server. Resources sent to the server may include, but are not limited to, all logical hard disks, clipboard contents, printers, connected peripheral devices, audio, and authentication features and facilities of the Windows operating system, including smart cards. This access could enable the threat actor to install malware on the target\u2019s local drive(s) and mapped network share(s), particularly in AutoStart folders, or install additional tools such as remote access trojans (RATs) to maintain access when the RDP session is closed. The process of establishing an RDP connection to the actor-controlled system may also expose the credentials of the user signed in to the target system.<\/p>\n\n\n

\"A
Figure 1. Malicious remote connection<\/figcaption><\/figure>\n\n\n\n

RDP connection<\/h3>\n\n\n\n

When the target user opened the .RDP attachment, an RDP connection was established to an actor-controlled system. The configuration of the RDP connection then allowed the actor-controlled system to discover and use information about the target system, including:<\/p>\n\n\n\n