'Midnight Blizzard' Targets Networks With Signed RDP Files

Midnight Blizzard (aka APT29) is running a large-scale spear-phishing campaign using digitally signed RDP configuration files to establish bidirectional connections that harvest user credentials, files, smart card data, web authentication credentials, and clipboard contents; the campaign has targeted governmental agencies, higher education, defense, and NGOs across dozens of countries and employs a signed RDP file to evade detection, with Microsoft publishing associated indicators of compromise and mitigations.