A sophisticated cyber espionage campaign by Russia-linked APT29 (tracked as Earth Koshchei) has emerged, targeting government entities, armed forces, think tanks, and Ukrainian organizations through malicious RDP configuration files.

The threat actor has repurposed a legitimate “rogue RDP” technique, originally documented by Black Hills Information Security in 2022. The campaign, which began in August 2024, has affected approximately 200 high-profile targets in a single day.

Key Attack Components:
– Spear-phishing emails containing malicious RDP configuration files (HUSTLECON)
– 193 RDP relays for connection routing
– PyRDP, an open-source Monster-in-the-Middle tool
– TOR exit nodes and residential proxies for anonymization

Attack Methodology:
1. Victims receive specially crafted emails with malicious RDP files
2. Opening the file initiates a connection to PyRDP relay
3. Connection redirects to attacker-controlled server
4. Attackers gain partial system control without malware deployment
5. Sensitive data exfiltration occurs through the compromised RDP session

The attack’s sophistication lies in its ability to collect data without custom malware, making detection particularly challenging. Multiple security organizations, including CERT-UA, Microsoft, and AWS, have documented these campaigns, highlighting their significant impact on cybersecurity landscapes.

The technique demonstrates APT29’s evolving tactics, combining both existing vulnerabilities and new red team methodologies for enhanced cyber espionage operations.