Not Simon the Goat on Nostr: Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP ...
Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
Since 22 October 2024, Microsoft Threat Intelligence observed Russian APT29 (tracked as Midnight Blizzard) sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. Microsoft assesses that the goal of this operation is likely intelligence collection.
The spear-phishing emails in this campaign were sent to thousands of targets in over 100 organizations and contained a signed Remote Desktop Protocol (RDP) configuration file that connected to an actor-controlled server. In some of the lures, the actor attempted to add credibility to their malicious messages by impersonating Microsoft employees. The threat actor also referenced other cloud providers in the phishing lures.
Microsoft describes the spearphishing campaign, RDP connection, and email infrastructure. Hunting queries and indicators of compromise provided. APT29, aka Cozy Bear and NOBELIUM, is publicly attributed to Russian Foreign Intelligence Service (SVR).
#russia #apt29 #svr #cozybear #midnightblizzard #IOC #threatintel #infosec #cybersecurity #cyberthreatintelligence #CTI
Since 22 October 2024, Microsoft Threat Intelligence observed Russian APT29 (tracked as Midnight Blizzard) sending a series of highly targeted spear-phishing emails to individuals in government, academia, defense, non-governmental organizations, and other sectors. Microsoft assesses that the goal of this operation is likely intelligence collection.
The spear-phishing emails in this campaign were sent to thousands of targets in over 100 organizations and contained a signed Remote Desktop Protocol (RDP) configuration file that connected to an actor-controlled server. In some of the lures, the actor attempted to add credibility to their malicious messages by impersonating Microsoft employees. The threat actor also referenced other cloud providers in the phishing lures.
Microsoft describes the spearphishing campaign, RDP connection, and email infrastructure. Hunting queries and indicators of compromise provided. APT29, aka Cozy Bear and NOBELIUM, is publicly attributed to Russian Foreign Intelligence Service (SVR).
#russia #apt29 #svr #cozybear #midnightblizzard #IOC #threatintel #infosec #cybersecurity #cyberthreatintelligence #CTI