Red teaming provides essential tools and testing methodologies for organizations to strengthen their security defenses. Cybercriminals and advanced persistent threat (APT) actors pay close attention to new methods and tools red teams develop, and they may repurpose them with a malicious intent.
In October 2024, an APT group that Trend Micro tracks as Earth Koshchei (also known as APT29 and Midnight Blizzard), likely used a rogue remote desktop protocol (RDP) attack methodology against numerous targets. This methodology was described earlier in 2022 by Black Hills Information Security in detail. The attack technique is called “rogue RDP”, which involves an RDP relay, a rogue RDP server, and a malicious RDP configuration file. A victim of this technique would give partial control of their machine to the attacker, potentially leading to data leakage and malware installation.
Read more…
Source: Trend Micro
Related:
- Bitcoin ATM company Coin Cloud hacked
December 12, 2023
In November, the cybersecurity collective vx-underground wrote on X, formerly Twitter, that unknown hackers were claiming to have breached Coin Cloud, a bankrupt Bitcoin ATM company. According to vx-underground, the hackers claimed to have stolen 70,000 pictures of customers taken from cameras embedded in the ATMs, as well as the personal data of 300,000 customers, which ...
- Spider-Man developer Insomniac Games suffers ransomware attack
December 12, 2023
Insomniac Games, the studio behind titles including Spyro, Ratchet & Clank and Marvel’s Spider-Man, has been breached by the Rhysidia ransomware group. Rhysidia shared screenshots of the stolen on its TOR site, including imagery from Insomniac’s upcoming game, Marvel’s Wolverine. Personal data like passport scans of current and former employees also appears to be included, as ...
- Russian diplomat accuses West of patronizing Ukrainian IT army that commits cybercrime
December 12, 2023
The US-led West supervises Ukraine’s so-called IT army that may be responsible for cybercrime, Russia’s representative Irina Tyazhlova said on Monday. Addressing a meeting of the UN Open-ended Working Group (OEWG) on security of and in the use of information and telecommunication technologies (ICTs), she said: “Other numerous malicious activities with the use of ICTs were ...
- US healthcare giant Norton says hackers stole millions of patients’ data during ransomware attack
December 11, 2023
Kentucky-based nonprofit healthcare system Norton Healthcare has confirmed that hackers accessed the personal data of millions of patients and employees during an earlier ransomware attack. Norton operates more than 40 clinics and hospitals in and around Louisville, Kentucky, and is the city’s third-largest private employer. The organization has more than 20,000 employees, and more than 3,000 ...
- PSNI data breach ‘wake-up call’ for UK forces, review says
December 11, 2023
A major data breach within the Police Service of Northern Ireland (PSNI) has been described as “a wake-up call” for forces across the UK. A report into the data leak has made 37 recommendations for improving information security within the PSNI. In August, the surnames and initials of all the PSNI’s 9,500 staff were released by ...
- China: Foreign geographic information software collects sensitive data, posing threat to national security
December 11, 2023
China’s national security agencies have discovered that foreign geographic information system software used in important industries in China has been collecting and transmitting geographic information data with some of the information collected involving state secrets, posing a serious threat to national security, China’s Ministry of State Security said on Monday, noting that national security agencies will ...