Amazon security teams executed domain seizures disrupting malicious infrastructure operated by Russian Foreign Intelligence Service (SVR) cyber-espionage actor APT29 (Midnight Blizzard, UAC-0215). The threat group launched a widespread spear-phishing campaign targeting government, military, and diplomatic entities across Europe and Ukraine using fraudulent domains impersonating Amazon Web Services (AWS) and Zero Trust compliance portals. Rather than delivering executable payloads, phishing lures distributed weaponized, digitally signed Remote Desktop Protocol (.rdp) configuration files that initiated outbound client connections to actor-controlled PyRDP servers.

The malicious .rdp configurations abuse native Windows Remote Desktop Virtual Channel Architecture through directives including drivestoredirect:s:* and redirectclipboard:i:1. When a victim opens the file via mstsc.exe, the client automatically mounts all local logical drives (such as C:\ and mapped network shares) to the remote session via the \\tsclient\ virtual channel and synchronizes host clipboards. This architecture grants attackers immediate filesystem traversal and credential-harvesting access—extracting browser session tokens, Windows DPAPI keys, and Kerberos tickets—without dropping unsigned binaries or triggering endpoint detection alerts. Amazon sinkholed the spoofed domains in coordination with CERT-UA, neutralizing the adversary’s staging servers.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Weaponizing native Windows RDP device redirection subverts conventional endpoint telemetry, turning legitimate outbound administrative sessions into direct data exfiltration pipelines that access local filesystems and memory-resident tokens without executing unverified code.
• Bullet 2 — Strategic & Defender Imperative: Organizations must block inbound .rdp file attachments at mail gateways, restrict outbound TCP/UDP port 3389 connections to authorized bastions, and enforce Group Policy Objects restricting client-side RDP drive and clipboard redirection across enterprise endpoints.