Russia’s APT29 Launches Major Spear Phishing Campaign

Trend Micro reports that Earth Koshchei (APT29/Cozy Bear) conducted a large-scale spear-phishing campaign, sending emails that delivered rogue RDP configuration files which redirected victims to a network of 193 attacker-controlled RDP relays; the actor registered over 200 phishing domains and used compromised legitimate mail servers to target governments, military, think tanks, researchers, and Ukrainian targets, with the campaign peaking on October 22.