Red teaming provides essential tools and testing methodologies for organizations to strengthen their security defenses. Cybercriminals and advanced persistent threat (APT) actors pay close attention to new methods and tools red teams develop, and they may repurpose them with a malicious intent.
In October 2024, an APT group that Trend Micro tracks as Earth Koshchei (also known as APT29 and Midnight Blizzard), likely used a rogue remote desktop protocol (RDP) attack methodology against numerous targets. This methodology was described earlier in 2022 by Black Hills Information Security in detail. The attack technique is called “rogue RDP”, which involves an RDP relay, a rogue RDP server, and a malicious RDP configuration file. A victim of this technique would give partial control of their machine to the attacker, potentially leading to data leakage and malware installation.
Read more…
Source: Trend Micro
Related:
- European Parliament Putin things back together after cyber attack
November 24, 2022
The European Parliament has experienced a cyber attack that started not long after it declared Russia to be a state sponsor of terrorism. The attack appears to have made part of the Parliament’s website inoperable and made access impossible for a few hours. A pro-Russian group called KILLNET appears to have claimed responsibility for the attack in ...
- Ducktail hackers now use WhatsApp to phish for Facebook Ad accounts
November 23, 2022
A cybercriminal operation tracked as Ducktail has been hijacking Facebook Business accounts causing losses of up to $600,000 in advertising credits. The gang has been spotted before using malware to steal Facebook-related information and hijack associated business accounts to run their own ads that are paid for by the victim. Believed to be the work of a ...
- WannaRen Returns as Life Ransomware, Targets India
November 23, 2022
Although not as well-known as ransomware families such as Ryuk, REvil, or Maze, WannaRen ransomware made a name for itself back in 2020 after it launched attacks against Chinese internet users, infecting tens of thousands of victims. However, it has become relatively quiet since that attack, with the ransomware’s authors even sharing its private encryption ...
- CISA Releases Eight Industrial Control Systems Advisories
November 22, 2022
CISA has released eight (8) Industrial Control Systems (ICS) advisories on 22 November 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisory for technical details and mitigations: ICSA-22-326-01 AVEVA Edge ICSA-22-326-02 Digital Alert Systems DASDEC ICSA-22-326-03 Phoenix Contact Automation Worx ICSA-22-326-04 GE ...
- Estonian duo accused of $575m cryptocurrency scam
November 22, 2022
Police in Estonia have arrested two men suspected of running a $575m (£485m) cryptocurrency scam involving hundreds of thousands of victims. Estonian police investigated the case with the FBI, and US authorities want to extradite the pair – Estonians Sergei Potapenko and Ivan Turogin. The two 37-year-olds allegedly got people to invest in a cryptocurrency mining service ...
- Donut extortion group also targets victims with ransomware
November 22, 2022
The Donut (D0nut) extortion group has been confirmed to deploy ransomware in double-extortion attacks on the enterprise. BleepingComputer first reported on the Donut extortion group in August, linking them to attacks on Greek natural gas company DESFA, UK architectural firm Sheppard Robson, and multinational construction company Sando. Strangely, the data for Sando and DESFA was also posted ...