Red teaming provides essential tools and testing methodologies for organizations to strengthen their security defenses. Cybercriminals and advanced persistent threat (APT) actors pay close attention to new methods and tools red teams develop, and they may repurpose them with a malicious intent.
In October 2024, an APT group that Trend Micro tracks as Earth Koshchei (also known as APT29 and Midnight Blizzard), likely used a rogue remote desktop protocol (RDP) attack methodology against numerous targets. This methodology was described earlier in 2022 by Black Hills Information Security in detail. The attack technique is called “rogue RDP”, which involves an RDP relay, a rogue RDP server, and a malicious RDP configuration file. A victim of this technique would give partial control of their machine to the attacker, potentially leading to data leakage and malware installation.
Read more…
Source: Trend Micro
Related:
- British Library suffering major technology outage after cyber-attack
October 31, 2023
The British Library is suffering a technology outage after it was hit by a cyber-attack, which is affecting services online and its sites in London and Yorkshire. Access to the website, as well as the catalogue and digital collections, is temporarily unavailable. The collection of items ordered on or after 27 October, new collection item orders ...
- India: What you need to know about the Apple and Aadhaar attacks
October 31, 2023
October 31 was a big day for data protection, privacy and surveillance. First, reports poured in about a massive breach of Aadhaar information, with estimates that the data of 815 million Indians had been put up for sale on the ‘dark web’. Soon after, many opposition leaders and civil society members began sharing messages they ...
- From Albania to the Middle East: The Scarred Manticore is listening
October 31, 2023
Check Point Research, in collaboration with Sygnia’s Incident Response Team, has been tracking and responding to the activities of Scarred Manticore, an Iranian nation-state threat actor that primarily targets government and telecommunication sectors in the Middle East. Scarred Manticore, linked to the prolific Iranian actor OilRig (a.k.a APT34, EUROPIUM, Hazel Sandstorm), has persistently pursued high-profile organizations, ...
- Canada bans Chinese app WeChat from government devices
October 30, 2023
Canada has announced it will ban WeChat on government devices. The Chinese-owned app is sometimes referred to as the “everything app” – like WhatsApp, Facebook, Amazon and Tinder all in one. However Western governments have security concerns about it, mainly that the app could be used to spy on users. WeChat is one of the most ...
- Step-by-step through the Money Message ransomware
October 30, 2023
In August 2023, the Sophos X-Ops Incident Response team was engaged to support an organization in Australia infected with Money Message ransomware. This attack vector, known for its stealth, does not append any file extensions to the encrypted data, making it harder for victims to identify the encrypted files simply by spotting such extensions. In ...
- CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
October 30, 2023
Unit 42 researchers have identified an active campaign we are calling EleKtra-Leak, which performs automated targeting of exposed identity and access management (IAM) credentials within public GitHub repositories. As a result of this, the threat actor associated with the campaign was able to create multiple AWS Elastic Compute (EC2) instances that they used for wide-ranging ...