APT Hackers Attacking RDP Servers to Deploy Malicious Payloads and Establish Persistence
## Overview of Recent Cyber Attack Campaign
Overview of Recent Cyber Attack Campaign
A notable state-backed hacking group is currently targeting Remote Desktop Protocol (RDP) servers. The group, known as APT-C-13, Sandworm, APT44, Seashell Blizzard, and Voodoo Bear, has been operational since 2009. In their latest campaign, they have shifted strategies from one-time attacks to prolonged infiltration aimed at intelligence gathering.
The attack begins with an ISO image labeled Microsoft.Office.2025x64.v2025.iso , disseminated via Telegram channels and software cracking communities. Victims who mount the image inadvertently execute malicious files disguised as auto.exe or setup.exe , which then deploy additional malicious modules.
The campaign exploits social engineering tactics, leveraging familiarity with software names to gain user trust. The initial loader analyzes the target system and deploys further payloads accordingly.
The APT-C-13 group utilizes a modular penetration framework known as the Tambur/Sumbur/Kalambur series. The Tambur module establishes persistence by creating scheduled tasks within Windows Diagnostic Infrastructure paths, maintaining access through administrator-level privileges.
A notable state-backed hacking group is currently targeting Remote Desktop Protocol (RDP) servers.
Additional modules such as Kalambur and Sumbur route command-and-control (C2) traffic via the Tor network, obscuring the attacker's location. SSH reverse tunneling is employed to map the victim's RDP port to a remote C2 server, facilitating undetected remote logins.
Security Implications and Recommendations
The campaign poses a significant threat as it primarily utilizes legitimate Windows tools, which evades detection by standard antivirus solutions. Organizations are advised to block unauthorized ISO images and activation tools to mitigate risk. Monitoring network behaviors like task creation, registry changes, and PowerShell executions is crucial. Regular security updates and comprehensive scans should be enforced.
Strengthening audit practices and implementing detection rules for atypical RDP and SSH activity can prevent sustained data extraction and intelligence theft.
Based on reporting by Cyber Security News.