UAC-0215

Executive Summary

UAC-0215, also known as APT29 or Midnight Blizzard, has conducted a large‑scale spearphishing campaign using signed Remote Desktop Protocol (RDP) files to gain illicit access to government, defense, and commercial organizations worldwide. The group leverages user credentials obtained via legitimate RDP sessions to move laterally into corporate networks and cloud environments for espionage objectives.

Goals & Targeting

The primary goal of UAC-0215 is espionage of sensitive governmental, defense‑related, and industrial information. By compromising high‑value accounts through spearphishing and legitimate RDP sessions, it seeks to harvest strategic data, infiltrate cloud infrastructures, and maintain long‑term undetected presence within targeted organizations.

Key Capabilities

• Spearphishing via email attachments
• Use of signed RDP configuration files as a novel initial access vector
• Impersonation of Microsoft employees in phishing messages
• Reference to cloud providers within lures
• Compromise of valid accounts and authentication mechanisms
• Lateral movement from on‑premises environments into cloud deployments
• Deployment of Active Directory Federation Service (AD FS) malware FOGGYWEB and MAGICWEB
• Bidirectional mapping of local device resources including hard disks, clipboard, printers, peripherals, audio, and authentication data
• Installation of malware via AutoStart folders or boot‑autostart mechanisms
• Use of remote access trojans to establish persistence and maintain control
• Privilege escalation through UAC bypasses and process injection
• Credential dumping with tools like Mimikatz
• Obfuscated delivery and payloads
• Scheduled job creation for persistence

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAC-0215 employed a high‑volume campaign against more than 100 organizations, primarily in Ukraine but also across the UK, South Korea, Japan, the US, Russia, China, India, Vietnam, Romania, North Korea, and Australia. The operational tempo was rapid—thousands of spearphishing emails were sent within weeks—indicating a prepared and well‑resourced threat actor. Victim profiles included government agencies, defense contractors, non‑profit organizations, manufacturing firms, healthcare providers, and educational institutions. Notable operations involved the deployment of signed RDP files to bypass standard authentication controls, followed by lateral movement into cloud accounts via compromised on‑premises credentials. The tactics suggest an emphasis on stealth, persistence, and collection of strategic data over destructive sabotage.

IOC Patterns

• domain
• file
• ip-v4

Recommended Actions

• Block RDP configuration files (.rdp) at mail gateways and enforce attachment whitelisting.
• Restrict outbound RDP connections from internal networks; limit to designated servers only.
• Implement MFA for all Remote Desktop access, particularly for privileged accounts.
• Monitor authentication logs for anomalous RDP logins originating from unapproved IPs or unusual patterns.
• Maintain strict least‑privilege principles in AD FS and revoke unused credentials promptly.
• Deploy Endpoint Detection and Response (EDR) solutions that detect malware such as FOGGYWEB, MAGICWEB, and RAT installations.
• Disable auto‑run and AutoStart folders on endpoint operating systems where possible.
• Regularly patch Windows update-related vulnerabilities that could be exploited via RDP.
• Use secure gateway or proxy for RDP sessions to inspect traffic for malicious payloads.
• Conduct user awareness training focused on spearphishing with attachments, especially those mimicking Microsoft communications.

Suggested Tags