Microsoft Warns of Russian Spear-Phishing Attacks

Microsoft warns of Russian spear-phishing attacks targeting over 100 organizations that has been attributed to the notorious Russian state-sponsored threat actor tracked by the company as Midnight Blizzard.

According to the tech giant, the campaign has targeted thousands of users at more than 100 organizations in the government, defense, academia, NGO and other sectors, likely with the goal of collecting intelligence.  

Midnight Blizzard is also known as APT29, Cozy Bear, the Dukes, and Yttrium, and it has been known to target these types of organizations, mainly in the United States and Europe. 

The threat actor is also known for recent attacks targeting Microsoft systems, in which the hackers managed to steal source code and spy on executive emails. 

The latest campaign, which Microsoft has been tracking for the past week, targeted the United Kingdom and other European countries, as well as Australia and Japan. The attacks are ongoing and the company has shared indicators of compromise (IoCs) to help organizations detect potential attacks. 

Read more: Malvertising Campaign Hijacks Facebook Accounts.

One new and noteworthy aspect of the campaign is that the spear-phishing emails sent out by the hackers, which sometimes impersonate Microsoft employees, contain a signed RDP configuration file that connects to an attacker-controlled server. 

The RDP configuration files contain automatic settings that cause features and resources of the local system to be extended to the attacker’s server, leading to the exposure of sensitive information. 

“Once the target system was compromised, it connected to the actor-controlled server and bidirectionally mapped the targeted user’s local device’s resources to the server,” Microsoft explained. “Resources sent to the server may include, but are not limited to, all logical hard disks, clipboard contents, printers, connected peripheral devices, audio, and authentication features and facilities of the Windows operating system, including smart cards.” 

“This access could enable the threat actor to install malware on the target’s local drive(s) and mapped network share(s), particularly in AutoStart folders, or install additional tools such as remote access trojans (RATs) to maintain access when the RDP session is closed,” the tech giant added.

AWS recently also published a blog post describing this campaign, after the cloud giant seized domains used by the threat actor to conduct attacks. Ukraine’s CERT-UA has also analyzed the campaign.