Pattern Micro warns that the Russian state-sponsored risk actor Earth Koshchei (also called “APT29” or “Cozy Bear”) is utilizing spear phishing emails to trick victims into connecting to rogue Distant Desktop Protocol (RDP) relays.
“Earth Koshchei’s rogue RDP marketing campaign reached its peak on October 22, when spear-phishing emails have been despatched to governments and armed forces, suppose tanks, educational researchers, and Ukrainian targets,” Pattern Micro explains.
“These emails have been designed to deceive recipients into utilizing a rogue RDP configuration file connected to the message. When opened, this RDP configuration file would instruct the goal pc to attempt to connect with a international RDP server by way of one of many 193 RDP relays Earth Koshchei had arrange.”
Pattern Micro emphasizes that the size of this spear phishing marketing campaign dwarfed comparable operations launched by different APT teams.
“The dimensions of the RDP marketing campaign was large: The variety of high-profile targets – about 200 – we noticed in in the future was about the identical measurement as one other APT group like Pawn Storm targets in weeks,” the researchers write. “This was not the primary time Earth Koshchei was linked to an enormous spear-phishing marketing campaign: In Could 2021, in addition they despatched spear-phishing emails to 1000’s of particular person accounts.”
The risk actor registered greater than 200 phishing domains in preparation for the marketing campaign, and despatched the spear phishing emails from respectable however compromised e mail servers.
“In August 2024, the registered domains steered concentrating on in opposition to governments and navy in Europe, the US, Japan, Ukraine, and Australia,” the researchers write. “On the finish of this month, domains have been registered that look to be associated to cloud suppliers and IT corporations. Then, in September 2024, there have been batches of domains that gave the impression to be based mostly on a number of suppose thanks and non-profit organizations. There have been additionally a number of domains associated to on-line digital platforms like Zoom, Google Meet, and Microsoft Groups.”
KnowBe4 empowers your workforce to make smarter safety selections each day. Over 70,000 organizations worldwide belief the KnowBe4 platform to strengthen their safety tradition and scale back human danger.
Pattern Micro has the story.