AWS Disrupts Russian APT29 Cyber Operation Using Malicious RDP Files to Steal Sensitive Data from Ukraine

Oct 26, 2024, 04:30 AM

Amazon Web Services (AWS) has taken action against domains associated with the Russian cyber espionage group APT29, which were reportedly used in a campaign to steal sensitive data. The AWS security team, in collaboration with the Ukrainian Computer Emergency Response Team (CERT-UA), identified that APT29 had been mimicking AWS to harvest Windows credentials from targets in Ukraine. This operation involved malicious Remote Desktop Protocol (RDP) files and was part of a broader phishing effort aimed at Ukrainian entities. CERT-UA has issued warnings regarding sophisticated email attacks utilizing these RDP files to breach sensitive systems in the region. The coordinated effort by AWS and CERT-UA aims to disrupt these malicious activities and protect against further cyber threats.