This method, described as “Rogue RDP” by GTIG, allows attackers to access the victim’s file systems, clipboard data, and potentially even system variables, all under the guise of a legitimate application check. The deployment of tools like PyRDP in potential attacks highlights a growing trend where attackers leverage existing system capabilities for stealthy, persistent access, making the continuous update of security practices imperative for all organizations. Drive and Clipboard Redirection: The configuration granted attackers read/write access to all victim drives, exposing file systems, environment variables, and clipboard data, including user-copied passwords. Deceptive RemoteApps: Instead of full desktop access, victims saw a windowed application named “AWS Secure Storage Connection Stability Test.” Hosted entirely on attacker servers, this RemoteApp masqueraded as a local tool while operating within the RDP session’s encrypted channel. In a sophisticated espionage campaign targeting European government and military institutions, hackers believed to be connected with Russian state actors have been utilizing a lesser-known feature of Windows Remote Desktop Protocol (RDP) to infiltrate systems. The attackers, in collaboration with the Ukrainian State Secure Communications and Information Security Agency, sent emails purporting to be from prestigious organizations like Amazon and Microsoft. GTIG also highlighted the potential use of an RDP proxy tool like PyRDP, which could automate tasks such as file exfiltration, clipboard capture, or session hijacking. The emails contained signed .rdp files, signed with valid SSL certificates, to bypass security measures that would alert users to potential risks. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Notably, the attackers leveraged Windows environment variables (%USERPROFILE%, %COMPUTERNAME%) as command-line arguments to the RemoteApp, enabling reconnaissance without deploying malware.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 08 Apr 2025 02:25:08 +0000