(Traffic_analyzer via Getty)
Russian state-sponsored hackers have been sending out spear-phishing emails posing as Microsoft employees in an attempt to infiltrate over 100 organizations.
On Tuesday, Microsoft published a blog post to warn the public about the phishing emails, which are still going out and have been sent to thousands of users.
The company has sourced the phishing emails to a Russian state-sponsored hacking group known as Midnight Blizzard or Cozy Bear, which has often targeted the US government. In January, the group broke into corporate email accounts at Microsoft.
Redmond says Midnight Blizzard launched a new wave of email phishing attacks starting on Oct. 22 with the goal of gathering intelligence from “individuals in government, academia, defense, non-governmental organizations, and other sectors.” Users in dozens of countries have been targeted, particularly in the UK, Europe, Australia, and Japan.
“In some of the lures, the actor attempted to add credibility to their malicious messages by impersonating Microsoft employees. The threat actor also referenced other cloud providers in the phishing lures,” Microsoft added.
The company published the blog post after Amazon and the Ukrainian government warned about Midnight Blizzard's phishing campaign. “We can say that the activity has a wide geography,” Ukraine cyber authorities said.
Spear-phishing works by tailoring the malicious email to specific victims. This can include making the email appear to come from a friend, colleague, or trusted contact, thereby tricking the recipient into taking the message seriously. The malicious email might then manipulate the victim into giving up a password or installing malware by opening a malicious attachment.
In this case, Russian hackers have been trying to trick targets into opening malicious attachments in emails to install a remote desktop configuration file. Launching the configuration file can cause the victim’s computer to connect to a hacker-controlled server, giving the Russian cyberspies a foothold in the machine.
(Microsoft)“Resources sent to the server may include, but are not limited to, all logical hard disks, clipboard contents, printers, connected peripheral devices, audio, and authentication features and facilities of the Windows operating system, including smart cards,” Microsoft added.
That access can also give the Russian hackers a way to install additional malware, including in the AutoStart folders, to maintain a presence on the computer even when the remote desktop protocol session is closed. “The process of establishing an RDP connection to the actor-controlled system may also expose the credentials of the user signed in to the target system,” Microsoft says.