Abbas Kudrati

Midnight Blizzard is conducting large-scale spear-phishing campaign using RDP files! In this campaign, the malicious .RDP attachment was configured with sensitive settings designed to enable significant information exposure. Once the target system was compromised, it established a connection with a server controlled by the threat actor. This connection facilitated bidirectional mapping of the targeted user's local device resources to the malicious server. Resources shared with the server included, but were not limited to, logical hard drives, clipboard data, printers, connected peripheral devices, audio streams, and authentication features of the Windows operating system, such as smart cards. This access allowed the threat actor to install malware on the local drives and mapped network shares of the victim, particularly in AutoStart folders, to achieve persistence. Additionally, they could deploy tools like remote access trojans (RATs) to retain control even after the RDP session ended. Furthermore, the process of establishing an RDP connection with the malicious server could expose the credentials of the user currently logged into the compromised system. Unfortunately, EDR/XDRs are rendered useless as they can either block ALL or NO .rdp files - there is no way to make an EDR inspect the RDP file for malicious settings or unauthorized servers. This is where SquareX can help and block this - our browser-native content inspection can automatically parse RDP files and scan for malicious intent and unauthorized servers. In this video, we simulate this attack and show how. We do all of this by deploying just a simple Browser Extension which works on ANY browser! If you are interested in knowing more: sqrx.com @getsquarex Original Microsoft Article: lnkd.in/gHSpeidb