APT Hackers Attacking RDP Servers to Deploy Malicious Payloads and Establish Persistence

APT-C-13 (aka Sandworm) is running a campaign (observed 2024–2026) that delivers a trojanized ISO ("Microsoft.Office.2025x64.v2025.iso") via Telegram/cracking communities to infect RDP-exposed hosts in critical infrastructure and government; installers (auto.exe/setup.exe) load a modular framework (Tambur/Kalambur/Sumbur/DemiMur) that establishes persistence through scheduled tasks in a fake Windows WDI path, tunnels RDP via SSH and Tor to hide C2, injects a forged root certificate, disables Defender protections, and enables months-long covert intelligence collection—recommendations include blocking unauthorized ISOs, monitoring scheduled tasks/registry/PowerShell activity, and creating detections for anomalous RDP/SSH behavior.