Russia's APT29 Mimics AWS Domains to Steal Windows Credentials

APT29 (aka Midnight Blizzard/Nobelium/Cozy Bear) ran a wide-reaching phishing campaign since August using malicious domains masquerading as AWS to deliver RDP configuration file attachments to government, military, and private-sector targets; those RDP files initiated outbound connections to attacker servers and granted broad remote access and script execution capabilities, enabling credential theft and persistence.