Loading story…
Amazon and Microsoft disclosed a large spear-phishing campaign by APT29/Midnight Blizzard, the Russian state-linked espionage group tied to the SVR, that used signed malicious .rdp files to trick targets into launching outbound Remote Desktop connections to attacker-controlled servers. The operation, tracked by CERT-UA as UAC-0215, relied on emails sent from previously compromised legitimate accounts and lures themed around Amazon Web Services, Microsoft, and Zero Trust integration issues. Amazon said the attackers used lookalike AWS-related domains, which it moved to seize, but the campaign was aimed at stealing victims' Windows credentials and collecting data rather than compromising Amazon or AWS customer accounts directly.
Microsoft said the campaign targeted thousands of recipients across dozens of countries, including Ukraine, the UK, Europe, Australia, and Japan, with victims spanning government, academia, defense, and NGOs. CERT-UA warned that opening the rogue RDP attachments could expose local disks, network shares, printers, COM ports, audio devices, clipboard contents, and credentials to the attackers, while also enabling unauthorized program or script execution for follow-on activity. Defenders were urged to block .rdp files at email gateways, monitor and restrict outbound RDP connections from mstsc.exe, and apply the indicators and mitigations published by Microsoft and CERT-UA.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly reported the ongoing Midnight Blizzard spear-phishing campaign, describing the use of signed malicious RDP configuration files and assessing the activity as intended for intelligence collection. Microsoft also published indicators and defensive guidance, including blocking RDP files at email gateways and restricting outbound RDP connections via mstsc.exe.
Amazon said it seized domains impersonating AWS-related infrastructure that were used in the campaign's lures themed around Amazon, Microsoft, and Zero Trust Architecture. Amazon stated the attackers were not targeting Amazon or AWS customer credentials directly, but instead sought victims' Windows credentials through Microsoft Remote Desktop.
CERT-UA identified the activity as UAC-0215 and warned that opening the malicious RDP attachments could expose local disks, network shares, clipboard contents, printers, audio devices, COM ports, and Windows credentials to attacker-controlled servers. It also warned the files could enable unauthorized program or script execution and published indicators and mitigations.
APT29/Midnight Blizzard began an espionage-focused spear-phishing campaign using emails from previously compromised legitimate accounts to deliver signed malicious .rdp files. The operation targeted thousands of recipients across dozens of countries, with primary impact reported in Ukraine and additional targeting of government, academia, defense, and NGO personnel in Europe, the UK, Australia, Japan, and other countries viewed as adversaries of Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceaws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that **APT29** conducted phishing campaigns that leveraged **Atlassian Trello** and cloud-hosted infrastructure to support credential theft and follow-on intrusion activity. The operation used legitimate online services to blend malicious traffic with normal business activity, a tactic that can complicate detection and attribution while helping the threat actor stage phishing lures and redirect victims through trusted platforms. The reporting links the activity to the Russia-aligned espionage group commonly tracked as **APT29**, which is known for stealthy, intelligence-focused operations against government and other high-value targets. The campaign highlights continued abuse of widely used SaaS and cloud services as part of state-backed phishing tradecraft, reinforcing the need for defenders to monitor suspicious authentication flows, investigate links delivered through trusted collaboration platforms, and harden identity protections against credential-harvesting attempts.
Jul 12, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Jun 29, 2026