CISA has received multiple reports of a large-scale spear-phishing campaign targeting organizations in several sectors, including government and information technology (IT). The foreign threat actor, often posing as a trusted entity, is sending spear-phishing emails containing malicious remote desktop protocol (RDP) files to targeted organizations to connect to and access files stored on the target’s network. Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network.
CISA, government, and industry partners are coordinating, responding, and assessing the impact of this campaign. CISA urges organizations to take proactive measures:
Restrict Outbound RDP Connections:
- It is strongly advised that organizations forbid or significantly restrict outbound RDP connections to external or public networks. This measure is crucial for minimizing exposure to potential cyber threats.
- Implement a Firewall along with secure policies and access control lists.
- Block RDP Files in Communication Platforms:
- Prevent Execution of RDP Files:
- Enable Multi-Factor Authentication (MFA):
- Adopt Phishing-Resistant Authentication Methods:
- Implement Conditional Access Policies:
- Deploy Endpoint Detection and Response (EDR):
- Consider Additional Security Solutions:
- Conduct User Education:
- Hunt For Activity Using Referenced Indicators and TTPs:
CISA urges users and administrators to remain vigilant against spear-phishing attempts, hunt for any malicious activity, report positive findings to CISA, and review the following articles for more information:
- Microsoft: Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files
- AWS Security: Amazon identified internet domains abused by APT29
- The Centre for Cybersecurity Belgium: Warning: Government-themed Phishing with RDP Attachments
- Computer Emergency Response Team of Ukraine: RDP configuration files as a means of obtaining remote access to a computer or "Rogue RDP"