HeptaX: Unauthorized RDP Connections In Cyberespionage

CRIL identified an ongoing multi-stage campaign dubbed “HeptaX” that starts from malicious .lnk attachments and uses PowerShell and BAT scripts to persist, create a hidden admin account (BootUEFI), disable UAC, weaken RDP authentication, and deploy ChromePass to harvest browser credentials; the report provides detailed stage analysis, C2 infrastructure (157.173.104.153), IoCs, and mitigation guidance.