Red teaming provides essential tools and testing methodologies for organizations to strengthen their security defenses. Cybercriminals and advanced persistent threat (APT) actors pay close attention to new methods and tools red teams develop, and they may repurpose them with a malicious intent.
In October 2024, an APT group that Trend Micro tracks as Earth Koshchei (also known as APT29 and Midnight Blizzard), likely used a rogue remote desktop protocol (RDP) attack methodology against numerous targets. This methodology was described earlier in 2022 by Black Hills Information Security in detail. The attack technique is called “rogue RDP”, which involves an RDP relay, a rogue RDP server, and a malicious RDP configuration file. A victim of this technique would give partial control of their machine to the attacker, potentially leading to data leakage and malware installation.
Read more…
Source: Trend Micro
Related:
- Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
August 28, 2025
Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations. GTIG now advise all Salesloft Drift customers to treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised. On August 28, 2025, GTIG ...
- Manitoba: Community that lost $472,000 to cyber attack failed to investigate
August 28, 2025
Manitoba’s auditor general says a rural municipality failed to properly investigate a cyber attack that resulted in the loss of hundreds of thousands of dollars. Tyson Shtykalo investigated the cybersecurity breach that led to the Municipality of Westlake-Gladstone, west of Winnipeg, losing more than $472,000 over the course of a few weeks in 2019 and 2020. Read ...
- Cyber-attack on UK contractor affects islanders
August 28, 2025
A personal data breach at a Disclosure and Barring Service (DBS) contractor has affected some people in Guernsey, officials have said. The Office of the Data Protection Authority (ODPA) said that UK-based company Access Personal Checking Services Ltd (APCS) had been notified that a third-party contractor had been subject to a cyber incident. APCS said the ...
- TransUnion says hackers stole 4.4 million customers’ personal information
August 28, 2025
Credit reporting giant TransUnion has disclosed a data breach affecting more than 4.4 million customers’ personal information. In a filing with Maine’s attorney general’s office on Thursday, TransUnion attributed the July 28 breach to unauthorized access of a third-party application storing customers’ personal data for its U.S. consumer support operations. TransUnion claimed “no credit information was ...
- Jamaica: Cyber attack on Office of Registrar General contained, but services impacted
August 27, 2025
The Office of the Registrar-General (ORG), formerly the Registrar General’s Department (RGD), says it was affected by a cyber incident detected on Sunday and is working to determine its full scope. “Our initial assessment indicates that this incident was primarily designed to disrupt the availability of our systems,” the ORG said Wednesday. “As investigations are still ...
- The first AI-powered proof of concept ransomware has been spotted
August 27, 2025
Security researchers from ESET have identified the first known AI-powered ransomware, which serves as a warning for security teams as generative AI has, and will, continue to make cyberattacks much more accessible for criminals. Peter Strycek and Anton Cherepanov discovered the proof of concept, which they dubbed ‘PromptLock’, which, ‘leverages Lua scripts generated from hard-coded prompts ...