Rogue RDP Servers and PyRDP: Preferred Tools of APT29 in Targeting High-Profile Victims

APT29, a threat actor associated with Russia, has recently been identified utilizing an unconventional strategy in cyber operations against valuable targets.

APT29, a threat actor associated with Russia, has recently been identified utilizing an unconventional strategy in cyber operations against valuable targets. By employing compromised Remote Desktop Protocol (RDP) setup files, they have repurposed a legitimate red team practice to conduct malicious activities.
These operations, primarily directed at governmental bodies, military establishments, research institutions, and entities based in Ukraine, involve the utilization of a “rogue RDP” approach that had been previously

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts