2024 · Dozens of countries, particularly the United Kingdom, Europe, Australia and Japan

Midnight Blizzard mails signed remote-desktop files to thousands of officials

In October 2024 Midnight Blizzard sent spear-phishing emails with signed RDP attachments. Opening one connected the computer to the attackers' server.

Published · Sources checked · 2 min read

When
From 22 October 2024
Who
Thousands of people in government, academia, defence and NGOs, in over 100 organisations
Where
Dozens of countries, particularly the United Kingdom, Europe, Australia and Japan
Way in
Spear-phishing emails from compromised real addresses, with a signed RDP configuration file attached
Tactics
A signed attachment, real sender addresses, impersonation of Microsoft staff, AWS lookalike domains
Loss or impact
Remote access to victims' devices and possible credential theft, for intelligence collection

What happened

On 22 October 2024 Microsoft identified a spear-phishing campaign by Midnight Blizzard, the group also known as APT29, which Western governments attribute to Russia's foreign intelligence service. Ukraine's national computer emergency team, CERT-UA, reported attacks on Ukrainian government, industrial and military targets around the same day. Amazon Web Services described the campaign on 24 October, and Microsoft published its analysis on 29 October.

Microsoft said the emails went to thousands of targets in over 100 organisations, in dozens of countries but particularly in the United Kingdom, Europe, Australia and Japan. The targets were in government agencies, higher education, defence and non-governmental organisations. Microsoft judged the aim to be intelligence collection.

The email

The emails came from addresses of real organisations that the group had compromised earlier. Some impersonated Microsoft employees. The lures were about Microsoft, AWS and security compliance. Each carried a Remote Desktop Protocol configuration file, the kind of small file that tells Windows how to connect to a remote computer. The files had names such as "AWS IAM Compliance Check.rdp" and "Device Security Requirements Check.rdp".

The files were signed with a certificate from Let's Encrypt, a free and widely used certificate authority. Opening one connected the victim's computer to a server controlled by the attackers and shared the computer's local resources with it. AWS added that some of the domains involved were built to look like AWS domains. CERT-UA's advice, reported in the press, was to block .rdp files at the mail gateway.

Why it worked

Each detail was chosen to pass a check. The sender addresses were real, so sender authentication passed. A valid signature makes a file look trustworthy, to people and to some filters. The file type is not a program in the usual sense, so filters built to stop executables could miss it. The topics were exactly what an IT-minded official expects to hear about from Microsoft or AWS: a compliance check, a device security requirement.

What it cost

A connection through such a file can expose the victim's drives and other local resources to the attackers' server, and it gives them a way to collect credentials. Microsoft and AWS did not publish how many targets opened the files. Amazon began seizing the domains the group had abused.

What would have helped

Few people outside IT need to receive RDP files by email at all. Blocking them at the gateway, as CERT-UA advised, removes the whole route. Inside an organisation, a policy that stops outbound remote-desktop connections to the internet helps too. A connection that never leaves the network cannot reach the attackers' server.

Sources

  1. Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files, Microsoft Threat Intelligence, 29 October 2024.
  2. Amazon identified internet domains abused by APT29, CJ Moses, AWS Security Blog, 24 October 2024.
  3. CERT-UA Identifies Malicious RDP Files in Latest Attack on Ukrainian Entities, The Hacker News, October 2024, reporting CERT-UA's alert.