Russian hackers use RDP proxies to steal data in MiTM attacks

Trend Micro and other reports describe APT29 (aka Midnight Blizzard/Earth Koshchei) running a large-scale rogue RDP campaign that uses 193 proxy servers and the PyRDP man-in-the-middle tool to intercept RDP sessions, log plaintext credentials and NTLM hashes, steal clipboard and shared-drive data, exfiltrate files in the background, and run remote commands or payloads; targets include government, military, diplomatic, IT/cloud, telecom, and cybersecurity organizations across multiple countries, and the attackers obscure infrastructure using commercial VPNs, TOR exit nodes, and residential proxies while delivering access via phishing attachments.