{"id":7321,"date":"2025-01-18T11:22:12","date_gmt":"2025-01-18T11:22:12","guid":{"rendered":"https:\/\/kocerroxy.com\/?p=7321"},"modified":"2025-01-27T09:18:06","modified_gmt":"2025-01-27T09:18:06","slug":"hackers-launch-rdp-proxy-attacks-to-steal-corporate-data","status":"publish","type":"post","link":"https:\/\/kocerroxy.com\/blog\/hackers-launch-rdp-proxy-attacks-to-steal-corporate-data\/","title":{"rendered":"Hackers Launch RDP Proxy Attacks to Steal Corporate Data"},"content":{"rendered":"\n

Russian hackers have built a massive RDP proxy network that steals sensitive data from prominent targets worldwide. The notorious APT29 group, known as “Midnight Blizzard,” manages 193 RDP proxy servers<\/strong><\/a> to execute sophisticated man-in-the-middle attacks. These hackers registered over 200 malicious domain names between August and October 2024, targeting Australian and Ukrainian government entities.<\/p>\n\n\n\n

The campaign reached its height on October 22, 2024. Think tanks, government organizations, and academic researchers became primary targets through spear-phishing emails. The attackers’ advanced PyRDP tool<\/strong><\/a> now intercepts RDP connections, steals credentials, and accesses shared drives without installing malware on target systems. This cyber threat affects sectors of all types, from armed forces to research institutions, making it one of the most dangerous threats under current surveillance.<\/p>\n\n\n\n

\n\n\n\n

<\/span>APT29’s RDP Proxy Infrastructure<\/strong><\/span><\/h2>
\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n