Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files

Oct. 30, 2024, 11:08 p.m.

Description

On October 22, 2024, Microsoft identified a spear-phishing campaign in which Midnight Blizzard sent phishing emails to thousands of users in over 100 organizations. The emails were highly targeted, using social engineering lures relating to Microsoft, Amazon Web Services (AWS), and the concept of Zero Trust. The emails contained a Remote Desktop Protocol (RDP) configuration file signed with a LetsEncrypt certificate. RDP configuration (.RDP) files summarize automatic settings and resource mappings that are established when a successful connection to an RDP server occurs.

Date

Published: Oct. 30, 2024, 10:04 p.m.

Created: Oct. 30, 2024, 10:04 p.m.

Modified: Oct. 30, 2024, 11:08 p.m.

Indicators

us-west-2.ua-sec.cloud

us-west-2.ua-energy.cloud

us-west-2.gov-ua.cloud

us-west-2-aws.ua-energy.cloud

us-west-2-aws.s3-ua.cloud

us-west-2-aws.mfa-gov.cloud

us-west-1.ukrtelecom.cloud

us-west-1.ua-gov.cloud

us-west-1.ua-energy.cloud

us-west-1.aws-ukraine.cloud

us-west-1-aws.gov-ua.cloud

us-west-1-amazon.ua-sec.cloud

us-west-1-amazon.ua-mil.cloud

us-west-1-amazon.ua-energy.cloud

us-east-console.ua-energy.cloud

us-east-2.ukrainesec.cloud

us-east-console.aws-ukraine.cloud

us-east-2.ua-sec.cloud

us-east-2.gov-ua.cloud

us-east-2.aws-ukraine.cloud

us-east-2-aws.ukrtelecom.cloud

us-east-2-aws.ua-gov.cloud

us-east-2-aws.gov-ua.cloud

us-east-1-aws.ua-sec.cloud

us-east-1-aws.ua-gov.cloud

us-east-1-aws.mfa-gov.cloud

us-east-1-aws.s3-ua.cloud

eu-west-3.ukrainesec.cloud

eu-west-3.ukrtelecom.cloud

eu-west-3.s3-ua.cloud

eu-west-3.s3-be.cloud

eu-west-3.mzv-sk.cloud

eu-west-3.presidencia-pt.cloud

eu-west-3.msz-pl.cloud

eu-west-3.mindef-nl.cloud

eu-west-3.minbuza.cloud

eu-west-3.mil-pl.cloud

eu-west-3.mil-be.cloud

eu-west-3.aws-ukraine.cloud

eu-west-3.amazonsolutions.cloud

eu-west-3-aws.ua-mil.cloud

eu-west-3-aws.s3-ua.cloud

eu-west-3-aws.s3-be.cloud

eu-west-3-aws.regeringskansliet-se.cloud

eu-west-3-aws.quirinale.cloud

eu-west-3-aws.mzv-sk.cloud

eu-west-3-aws.msz-pl.cloud

eu-west-3-aws.mindef-nl.cloud

eu-west-3-aws.minbuza.cloud

eu-west-3-aws.mil-pt.cloud

eu-west-3-aws.mil-pl.cloud

eu-west-3-aws.mil-be.cloud

eu-west-3-aws.gov-trust.cloud

eu-west-3-aws.gov-sk.cloud

eu-west-3-aws.gov-pl.cloud

eu-west-3-aws.difesa-it.cloud

eu-west-3-aws.dep-no.cloud

eu-west-2-aws.ua-sec.cloud

eu-west-3-aws.aws-ukraine.cloud

eu-west-2-aws.s3-ua.cloud

eu-west-2-aws.s3-nato.cloud

eu-west-2-aws.s3-esa.cloud

eu-west-2-aws.s3-de.cloud

eu-west-2-aws.s3-be.cloud

eu-west-2-aws.quirinale.cloud

eu-west-2-aws.mzv-sk.cloud

eu-west-2-aws.mindef-nl.cloud

eu-west-2-aws.msz-pl.cloud

eu-west-2-aws.minbuza.cloud

eu-west-2-aws.mil-be.cloud

eu-west-2-aws.mil-pl.cloud

eu-west-2-aws.gv-at.cloud

eu-west-2-aws.gov-sk.cloud

eu-west-2-aws.gov-pl.cloud

eu-west-2-aws.difesa-it.cloud

eu-west-2-aws.dep-no.cloud

eu-west-2-aws.amazonsolutions.cloud

eu-west-1.ukrtelecom.cloud

eu-west-1.s3-ua.cloud

eu-west-1.ua-gov.cloud

eu-west-1.s3-esa.cloud

eu-west-1.s3-de.cloud

eu-west-1.mzv-sk.cloud

eu-west-1.regeringskansliet-se.cloud

eu-west-1.msz-pl.cloud

eu-west-1.minbuza.cloud

eu-west-1.mil-pl.cloud

eu-west-1.gov-sk.cloud

eu-west-1.mil-be.cloud

eu-west-1.difesa-it.cloud

eu-west-1.aws-ukraine.cloud

eu-west-1-aws.ukrainesec.cloud

eu-west-1-aws.ua-sec.cloud

eu-west-1-aws.s3-nato.cloud

eu-west-1-aws.s3-esa.cloud

eu-west-1-aws.s3-de.cloud

eu-west-1-aws.s3-be.cloud

eu-west-1-aws.quirinale.cloud

eu-west-1-aws.mil-pl.cloud

eu-west-1-aws.minbuza.cloud

eu-west-1-aws.mil-be.cloud

eu-west-1-aws.gov-ua.cloud

eu-west-1-aws.gov-trust.cloud

eu-west-1-aws.gov-sk.cloud

eu-west-1-aws.gov-pl.cloud

eu-west-1-aws.aws-ukraine.cloud

eu-west-1-aws.dep-no.cloud

eu-west-1-aws.amazonsolutions.cloud

eu-southeast-1-aws.ukrainesec.cloud

eu-southeast-1-aws.ua-energy.cloud

eu-southeast-1-aws.s3-ua.cloud

eu-southeast-1-aws.s3-esa.cloud

eu-southeast-1-aws.s3-de.cloud

eu-southeast-1-aws.s3-be.cloud

eu-southeast-1-aws.quirinale.cloud

eu-southeast-1-aws.mzv-sk.cloud

eu-southeast-1-aws.mzv-cz.cloud

eu-southeast-1-aws.msz-pl.cloud

eu-southeast-1-aws.mindef-nl.cloud

eu-southeast-1-aws.mil-be.cloud

eu-southeast-1-aws.mil-pl.cloud

eu-southeast-1-aws.gov-trust.cloud

eu-southeast-1-aws.gov-sk.cloud

eu-southeast-1-aws.difesa-it.cloud

eu-southeast-1-aws.amazonsolutions.cloud

eu-southeast-1-aws.dep-no.cloud

eu-southeast-1-aws.aws-ukraine.cloud

eu-south-2.ukrainesec.cloud

eu-south-2.ua-sec.cloud

eu-south-2.s3-nato.cloud

eu-south-2.s3-de.cloud

eu-south-2.s3-esa.cloud

eu-south-2.s3-be.cloud

eu-south-2.mindef-nl.cloud

eu-south-2.mil-be.cloud

eu-south-2.mil-pl.cloud

eu-south-2.gov-pl.cloud

eu-south-2.gov-sk.cloud

eu-south-2.dep-no.cloud

eu-south-2-aws.s3-ua.cloud

eu-south-2-aws.ua-gov.cloud

eu-south-2-aws.s3-nato.cloud

eu-south-2-aws.s3-esa.cloud

eu-south-2-aws.s3-de.cloud

eu-south-2-aws.s3-be.cloud

eu-south-2-aws.quirinale.cloud

eu-south-2-aws.regeringskansliet-se.cloud

eu-south-2-aws.ncfta.cloud

eu-south-2-aws.mzv-sk.cloud

eu-south-2-aws.msz-pl.cloud

eu-south-2-aws.minbuza.cloud

eu-south-2-aws.mil-be.cloud

eu-south-2-aws.mil-pt.cloud

eu-south-2-aws.mil-pl.cloud

eu-south-2-aws.gov-sk.cloud

eu-south-2-aws.mfa-gov.cloud

eu-south-2-aws.gov-pl.cloud

eu-south-2-aws.dep-no.cloud

eu-south-2-aws.amazonsolutions.cloud

eu-south-1-aws.ua-gov.cloud

eu-south-1-aws.s3-de.cloud

eu-south-1-aws.s3-be.cloud

eu-south-1-aws.quirinale.cloud

eu-south-1-aws.mzv-sk.cloud

eu-south-1-aws.minbuza.cloud

eu-south-1-aws.mil-be.cloud

eu-south-1-aws.mfa-gov.cloud

eu-south-1-aws.gov-trust.cloud

eu-south-1-aws.gov-pl.cloud

eu-south-1-aws.difesa-it.cloud

eu-south-1-aws.dep-no.cloud

eu-south-1-aws.admin-ch.cloud

eu-north-1.s3-ua.cloud

eu-north-1.s3-de.cloud

eu-north-1.s3-be.cloud

eu-north-1.regeringskansliet-se.cloud

eu-north-1.ncfta.cloud

eu-north-1.mil-pl.cloud

eu-north-1.mzv-sk.cloud

eu-north-1.mil-be.cloud

eu-north-1.gv-at.cloud

eu-north-1.gov-ua.cloud

eu-north-1.gov-trust.cloud

eu-north-1.difesa-it.cloud

eu-north-1-aws.ua-gov.cloud

eu-north-1-aws.ua-energy.cloud

eu-north-1-aws.s3-de.cloud

eu-north-1-aws.s3-be.cloud

eu-north-1-aws.regeringskansliet-se.cloud

eu-north-1-aws.quirinale.cloud

eu-north-1-aws.presidencia-pt.cloud

eu-north-1-aws.minbuza.cloud

eu-north-1-aws.ncfta.cloud

eu-north-1-aws.mil-pl.cloud

eu-north-1-aws.mil-be.cloud

eu-north-1-aws.gov-sk.cloud

eu-north-1-aws.gov-pl.cloud

eu-north-1-aws.dep-no.cloud

eu-north-1-aws.difesa-it.cloud

eu-east-1-aws.ukrtelecom.cloud

eu-east-1-aws.s3-de.cloud

eu-east-1-aws.ua-sec.cloud

eu-east-1-aws.ua-gov.cloud

eu-east-1-aws.s3-be.cloud

eu-east-1-aws.quirinale.cloud

eu-east-1-aws.regeringskansliet-se.cloud

eu-east-1-aws.msz-pl.cloud

eu-east-1-aws.mzv-sk.cloud

eu-east-1-aws.mindef-nl.cloud

eu-east-1-aws.minbuza.cloud

eu-east-1-aws.mil-pl.cloud

eu-east-1-aws.mil-be.cloud

eu-east-1-aws.gov-sk.cloud

eu-east-1-aws.gov-ua.cloud

eu-east-1-aws.dep-no.cloud

eu-central-2-aws.ukrtelecom.cloud

eu-east-1-aws.amazonsolutions.cloud

eu-central-2-aws.ua-mil.cloud

eu-central-2-aws.s3-be.cloud

eu-central-2-aws.regeringskansliet-se.cloud

eu-central-2-aws.ua-gov.cloud

eu-central-2-aws.presidencia-pt.cloud

eu-central-2-aws.mzv-sk.cloud

eu-central-2-aws.msz-pl.cloud

eu-central-2-aws.mindef-nl.cloud

eu-central-2-aws.mil-pl.cloud

eu-central-2-aws.mil-be.cloud

eu-central-2-aws.gov-sk.cloud

eu-central-2-aws.gov-pl.cloud

eu-central-2-aws.dep-no.cloud

eu-central-2-aws.aws-ukraine.cloud

eu-central-2-aws.amazonsolutions.cloud

eu-central-1.ua-gov.cloud

eu-central-1.ukrtelecom.cloud

eu-central-1.ua-sec.cloud

eu-central-1.s3-nato.cloud

eu-central-1.s3-be.cloud

eu-central-1.s3-esa.cloud

eu-central-1.regeringskansliet-se.cloud

eu-central-1.quirinale.cloud

eu-central-1.msz-pl.cloud

eu-central-1.mindef-nl.cloud

eu-central-1.minbuza.cloud

eu-central-1.mil-pl.cloud

eu-central-1.mil-be.cloud

eu-central-1.mfa-gov.cloud

eu-central-1-aws.ukrainesec.cloud

eu-central-1.difesa-it.cloud

eu-central-1-aws.ua-gov.cloud

eu-central-1-aws.s3-ua.cloud

eu-central-1-aws.s3-be.cloud

eu-central-1-aws.regeringskansliet-se.cloud

eu-central-1-aws.ncfta.cloud

eu-central-1-aws.quirinale.cloud

eu-central-1-aws.presidencia-pt.cloud

eu-central-1-aws.mzv-sk.cloud

eu-central-1-aws.mindef-nl.cloud

eu-central-1-aws.msz-pl.cloud

eu-central-1-aws.minbuza.cloud

eu-central-1-aws.gov-trust.cloud

eu-central-1-aws.mfa-gov.cloud

eu-central-1-aws.gov-sk.cloud

eu-central-1-aws.gov-pl.cloud

eu-central-1-aws.amazonsolutions.cloud

eu-central-1-aws.dep-no.cloud

central-2-aws.ukrtelecom.cloud

central-2-aws.ukrainesec.cloud

central-2-aws.ua-sec.cloud

central-2-aws.ua-mil.cloud

ca-west-1.mfa-gov.cloud

ca-west-1.ukrtelecom.cloud

ca-west-1.aws-ukraine.cloud

ca-central-1.ua-gov.cloud

ca-central-1.gov-ua.cloud

ap-northeast-1-aws.ukrainesec.cloud

ap-northeast-1-aws.s3-ua.cloud

totalconstruction.com.au

townoflakelure.com

swpartners.com.au

cewalton.com

sellar.co.uk

Attack Patterns

HustleCon

Midnight Blizzard

T1115

T1199

T1021

T1176

T1566