The Russian hacking group APT29 (Midnight Blizzard) has deployed an extensive network of 193 remote desktop protocol (RDP) proxy servers to conduct sophisticated man-in-the-middle (MiTM) attacks. Using the PyRDP red team proxy tool, the group targets sensitive data, credentials, and system access across multiple countries.

Key Findings:
– Primary targets include government, military, diplomatic, IT, cloud service, telecommunications, and cybersecurity organizations
– Affected countries: US, France, Australia, Ukraine, Portugal, Germany, Israel, Greece, Turkey, and Netherlands
– Infrastructure includes 193 proxy servers connecting to 34 attacker-controlled backend servers

Attack Methodology:
1. Victims are lured through phishing emails to connect to malicious RDP servers
2. PyRDP tool intercepts communications while maintaining appearance of legitimate connections
3. Attackers gain access to:
– Plaintext credentials and NTLM hashes
– Clipboard data
– File transfers
– Shared drives
– System command execution capabilities

Security Measures:
– The group employs cryptocurrency-based VPN services, TOR exit nodes, and residential proxies for IP address obfuscation
– Attack infrastructure mimics legitimate AWS security testing services

Prevention Recommendations:
– Connect only to known, trusted RDP servers
– Avoid RDP connections received through email attachments
– Implement robust email security measures
– Monitor for suspicious RDP connection attempts

This campaign demonstrates APT29’s evolving tactics in cyber espionage, highlighting the need for enhanced security awareness and protective measures against sophisticated RDP-based attacks.