In recent years, cybercriminals have become craftier in their attack strategies, employing complex and sophisticated methods to infiltrate computer systems and networks. One such attack is a state-sponsored espionage campaign that targets incoming Remote Desktop Protocol (RDP) connections. This campaign aims to infect connecting clients with a backdoor that allows threat actors to gain unauthorized access and steal sensitive information from organizations. Security firm Bitdefender has issued a warning regarding this campaign and its use of custom malware to orchestrate the attacks.
Background on the campaign
Since the beginning of 2022, a state-sponsored espionage campaign has been targeting RDP connections of organizations worldwide. Bitdefender reports that this campaign aligns with China-based threat actors, indicating that the attacks may be politically motivated. Moreover, the threat actor behind the attacks has been active since at least 2020, highlighting the sophistication and persistence of the attackers.
Custom tools used in the campaign
The state-sponsored espionage campaign utilizes two custom tools written in the Go programming language: the Logutil backdoor and the RDStealer malware. RDStealer is unique in that it captures clipboard content, logs keystrokes, and elevates user privileges to harvest information from infected machines. However, the most dangerous feature of RDStealer is its ability to monitor incoming RDP connections and infect connecting clients with client drive mapping (CDM) enabled.
Activities of the Logutil Backdoor
Once RDStealer infects a system, it continuously monitors for RDP connections with CredSSP (Credential Security Support Provider) enabled. If detected, it notifies the command-and-control (C&C) server, exfiltrates data from the client machine, and deploys the Logutil backdoor on the client.
Logutil uses multiple DLL sideloading techniques to evade detection, including abusing the Windows Management Instrumentation service (Winmgmt). It establishes persistence on the infected system and communicates with the C&C server directly or through a proxy server on the same network. The backdoor executes commands retrieved from the C&C server, such as loading DLL libraries, executing commands, uploading and downloading files, and listing folders.
The state-sponsored espionage campaign poses a significant threat to organizations because it allows attackers to steal sensitive information and potentially spread malware across systems. Once a system is infected with RDStealer, attackers can monitor and intercept the user’s activities, including passwords, files, and intellectual property. When the attackers exfiltrate this information, they can sell it or use it for other malicious purposes. Additionally, attackers can use the compromised machines to further spread malware across internal networks, causing widespread damage to organizations.
The state-sponsored espionage campaign targeting RDP connections with custom malware is a sophisticated and dangerous attack that organizations must take seriously. To mitigate the risks posed by this attack, organizations must prioritize RDP security measures, including implementing multi-factor authentication, monitoring for anomalous activity, and regularly patching remote access systems. Additionally, organizations must remain vigilant for evolving attack strategies and deploy security solutions that can identify and respond to threats quickly. By prioritizing security and threat monitoring, organizations can effectively combat this and other advanced threats.