Midnight Blizzard Launches Sophisticated Spear-Phishing Attack Using RDP Files

The nation-state-backed group, Midnight Blizzard, is conducting a large-scale spear-phishing campaign leveraging Remote Desktop Protocol (RDP) files to infiltrate critical government and defense systems. This attack targets governments, NGOs, and academic institutions, with a focus on gathering sensitive intelligence data. Microsoft identified the campaign, seeing it as a shift towards broader reach, supported by the use of RDP configuration files—a method not previously employed by the group. Victims, when opening these files, inadvertently allow hackers to establish RDP sessions that map critical systems and data to servers controlled by attackers. This campaign, active since late October, poses risks including unauthorized access to files and credentials, and the potential installation of malware. In defense, Xage Security advises using their zero-trust solutions to convert RDP sessions into secure HTTPS connections and apply multi-factor authentication. Organizations are urged to adopt a zero-trust approach to enhance security measures and mitigate future sophisticated attacks like this.