{
  "name": "Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks",
  "slug": "earth-koshchei-coopts-red-team-tools-in-complex-rdp-attacks",
  "description": "Earth Koshchei, an APT group suspected to be sponsored by the Russian SVR, executed a large-scale rogue RDP campaign targeting high-profile sectors. The attack methodology involved spear-phishing emails, red team tools, and sophisticated anonymization techniques. The campaign used an RDP relay, rogue RDP server, and malicious RDP configuration files to potentially leak data and install malware. The group registered over 200 domain names between August and October, setting up 193 RDP relays and 34 rogue RDP backend servers. They employed anonymization layers like VPN services, TOR, and residential proxies to mask their operations. The campaign peaked on October 22, targeting governments, armed forces, think tanks, academic researchers, and Ukrainian entities.",
  "published": "2024-12-17T15:20:09+00:00",
  "created_at": "2024-12-17T15:20:09+00:00",
  "modified_at": "2024-12-17T15:51:37+00:00",
  "created_at_opencti": "2024-12-17T15:20:09+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-12-17",
    "apt29",
    "data exfiltration",
    "midnight blizzard",
    "python remote desktop protocol mitm tool (pyrdp)",
    "roguerdp",
    "spear-phishing",
    "tor exit nodes"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "95.217.113.133"
      },
      {
        "id": "",
        "name": "93.188.164.74"
      },
      {
        "id": "",
        "name": "95.156.207.121"
      },
      {
        "id": "",
        "name": "93.188.163.16"
      },
      {
        "id": "",
        "name": "92.204.164.50"
      },
      {
        "id": "",
        "name": "89.46.234.93"
      },
      {
        "id": "",
        "name": "89.46.234.152"
      },
      {
        "id": "",
        "name": "89.46.234.115"
      },
      {
        "id": "",
        "name": "89.35.131.153"
      },
      {
        "id": "",
        "name": "84.32.188.200"
      },
      {
        "id": "",
        "name": "84.32.188.193"
      },
      {
        "id": "",
        "name": "84.32.188.197"
      },
      {
        "id": "",
        "name": "84.32.188.153"
      },
      {
        "id": "",
        "name": "82.180.139.47"
      },
      {
        "id": "",
        "name": "84.32.188.148"
      },
      {
        "id": "",
        "name": "81.17.31.106"
      },
      {
        "id": "",
        "name": "80.87.206.241"
      },
      {
        "id": "",
        "name": "66.206.13.130"
      },
      {
        "id": "",
        "name": "62.72.7.213"
      },
      {
        "id": "",
        "name": "5.187.49.186"
      },
      {
        "id": "",
        "name": "5.183.95.240"
      },
      {
        "id": "",
        "name": "5.183.95.158"
      },
      {
        "id": "",
        "name": "5.133.9.252"
      },
      {
        "id": "",
        "name": "46.30.189.91"
      },
      {
        "id": "",
        "name": "46.30.189.62"
      },
      {
        "id": "",
        "name": "46.30.188.187"
      },
      {
        "id": "",
        "name": "46.249.38.131"
      },
      {
        "id": "",
        "name": "45.86.162.170"
      },
      {
        "id": "",
        "name": "46.19.141.186"
      },
      {
        "id": "",
        "name": "45.82.66.39"
      },
      {
        "id": "",
        "name": "45.80.193.9"
      },
      {
        "id": "",
        "name": "45.67.85.40"
      },
      {
        "id": "",
        "name": "45.67.84.14"
      },
      {
        "id": "",
        "name": "45.141.58.60"
      },
      {
        "id": "",
        "name": "45.41.187.233"
      },
      {
        "id": "",
        "name": "45.141.58.59"
      },
      {
        "id": "",
        "name": "45.137.213.17"
      },
      {
        "id": "",
        "name": "45.137.21.11"
      },
      {
        "id": "",
        "name": "45.137.21.10"
      },
      {
        "id": "",
        "name": "45.134.111.126"
      },
      {
        "id": "",
        "name": "45.134.111.123"
      },
      {
        "id": "",
        "name": "45.134.110.83"
      },
      {
        "id": "",
        "name": "45.134.110.78"
      },
      {
        "id": "",
        "name": "45.134.110.82"
      },
      {
        "id": "",
        "name": "45.134.110.55"
      },
      {
        "id": "",
        "name": "45.11.231.8"
      },
      {
        "id": "",
        "name": "45.11.230.60"
      },
      {
        "id": "",
        "name": "45.11.231.9"
      },
      {
        "id": "",
        "name": "45.11.230.155"
      },
      {
        "id": "",
        "name": "45.11.230.144"
      },
      {
        "id": "",
        "name": "45.11.230.111"
      },
      {
        "id": "",
        "name": "45.11.230.105"
      },
      {
        "id": "",
        "name": "38.180.91.2"
      },
      {
        "id": "",
        "name": "38.180.90.36"
      },
      {
        "id": "",
        "name": "38.180.83.103"
      },
      {
        "id": "",
        "name": "38.180.83.120"
      },
      {
        "id": "",
        "name": "38.180.88.106"
      },
      {
        "id": "",
        "name": "38.180.230.79"
      },
      {
        "id": "",
        "name": "38.180.81.168"
      },
      {
        "id": "",
        "name": "38.180.5.60"
      },
      {
        "id": "",
        "name": "38.180.199.28"
      },
      {
        "id": "",
        "name": "38.180.146.32"
      },
      {
        "id": "",
        "name": "38.180.146.30"
      },
      {
        "id": "",
        "name": "38.180.146.29"
      },
      {
        "id": "",
        "name": "38.180.146.230"
      },
      {
        "id": "",
        "name": "38.180.146.28"
      },
      {
        "id": "",
        "name": "38.180.146.210"
      },
      {
        "id": "",
        "name": "38.180.146.216"
      },
      {
        "id": "",
        "name": "38.180.146.193"
      },
      {
        "id": "",
        "name": "38.180.137.213"
      },
      {
        "id": "",
        "name": "38.180.146.178"
      },
      {
        "id": "",
        "name": "38.180.136.93"
      },
      {
        "id": "",
        "name": "38.180.110.238"
      },
      {
        "id": "",
        "name": "37.28.157.246"
      },
      {
        "id": "",
        "name": "37.28.153.214"
      },
      {
        "id": "",
        "name": "37.1.196.172"
      },
      {
        "id": "",
        "name": "23.227.194.189"
      },
      {
        "id": "",
        "name": "23.160.56.95"
      },
      {
        "id": "",
        "name": "23.160.56.90"
      },
      {
        "id": "",
        "name": "23.160.56.123"
      },
      {
        "id": "",
        "name": "23.160.56.122"
      },
      {
        "id": "",
        "name": "23.160.56.115"
      },
      {
        "id": "",
        "name": "23.160.56.110"
      },
      {
        "id": "",
        "name": "23.160.56.105"
      },
      {
        "id": "",
        "name": "212.1.213.200"
      },
      {
        "id": "",
        "name": "23.160.56.100"
      },
      {
        "id": "",
        "name": "212.1.213.198"
      },
      {
        "id": "",
        "name": "209.182.225.10"
      },
      {
        "id": "",
        "name": "2.58.203.61"
      },
      {
        "id": "",
        "name": "2.58.201.27"
      },
      {
        "id": "",
        "name": "2.58.201.112"
      },
      {
        "id": "",
        "name": "2.58.200.80"
      },
      {
        "id": "",
        "name": "2.58.200.79"
      },
      {
        "id": "",
        "name": "2.58.200.78"
      },
      {
        "id": "",
        "name": "2.58.14.80"
      },
      {
        "id": "",
        "name": "198.50.106.141"
      },
      {
        "id": "",
        "name": "198.50.106.140"
      },
      {
        "id": "",
        "name": "195.3.220.48"
      },
      {
        "id": "",
        "name": "194.37.97.189"
      },
      {
        "id": "",
        "name": "193.29.59.9"
      },
      {
        "id": "",
        "name": "193.29.56.221"
      },
      {
        "id": "",
        "name": "193.200.17.162"
      },
      {
        "id": "",
        "name": "192.36.57.107"
      },
      {
        "id": "",
        "name": "192.36.27.226"
      },
      {
        "id": "",
        "name": "192.121.23.126"
      },
      {
        "id": "",
        "name": "190.211.254.32"
      },
      {
        "id": "",
        "name": "188.214.33.222"
      },
      {
        "id": "",
        "name": "185.76.79.86"
      },
      {
        "id": "",
        "name": "185.76.79.62"
      },
      {
        "id": "",
        "name": "185.76.79.60"
      },
      {
        "id": "",
        "name": "185.76.79.59"
      },
      {
        "id": "",
        "name": "185.76.79.53"
      },
      {
        "id": "",
        "name": "185.76.79.244"
      },
      {
        "id": "",
        "name": "185.76.79.233"
      },
      {
        "id": "",
        "name": "185.76.79.190"
      },
      {
        "id": "",
        "name": "185.76.79.229"
      },
      {
        "id": "",
        "name": "185.76.79.178"
      },
      {
        "id": "",
        "name": "185.76.79.167"
      },
      {
        "id": "",
        "name": "185.76.79.16"
      },
      {
        "id": "",
        "name": "185.76.79.140"
      },
      {
        "id": "",
        "name": "185.76.79.130"
      },
      {
        "id": "",
        "name": "185.76.79.118"
      },
      {
        "id": "",
        "name": "185.243.115.124"
      },
      {
        "id": "",
        "name": "185.243.114.9"
      },
      {
        "id": "",
        "name": "185.243.112.24"
      },
      {
        "id": "",
        "name": "185.216.72.196"
      },
      {
        "id": "",
        "name": "185.216.72.192"
      },
      {
        "id": "",
        "name": "185.216.72.185"
      },
      {
        "id": "",
        "name": "185.216.72.182"
      },
      {
        "id": "",
        "name": "185.187.155.81"
      },
      {
        "id": "",
        "name": "185.187.155.79"
      },
      {
        "id": "",
        "name": "185.187.155.78"
      },
      {
        "id": "",
        "name": "185.187.155.74"
      },
      {
        "id": "",
        "name": "185.187.155.73"
      },
      {
        "id": "",
        "name": "185.187.155.72"
      },
      {
        "id": "",
        "name": "185.187.155.71"
      },
      {
        "id": "",
        "name": "185.187.155.69"
      },
      {
        "id": "",
        "name": "185.187.155.33"
      },
      {
        "id": "",
        "name": "185.177.126.225"
      },
      {
        "id": "",
        "name": "185.172.39.52"
      },
      {
        "id": "",
        "name": "185.172.39.51"
      },
      {
        "id": "",
        "name": "185.172.39.50"
      },
      {
        "id": "",
        "name": "185.172.39.230"
      },
      {
        "id": "",
        "name": "185.172.39.220"
      },
      {
        "id": "",
        "name": "185.100.234.105"
      },
      {
        "id": "",
        "name": "179.43.180.74"
      },
      {
        "id": "",
        "name": "179.43.163.18"
      },
      {
        "id": "",
        "name": "179.43.148.82"
      },
      {
        "id": "",
        "name": "178.255.43.30"
      },
      {
        "id": "",
        "name": "178.239.171.41"
      },
      {
        "id": "",
        "name": "178.162.203.91"
      },
      {
        "id": "",
        "name": "176.97.70.55"
      },
      {
        "id": "",
        "name": "175.110.114.9"
      },
      {
        "id": "",
        "name": "175.110.112.221"
      },
      {
        "id": "",
        "name": "172.96.137.125"
      },
      {
        "id": "",
        "name": "172.86.73.187"
      },
      {
        "id": "",
        "name": "172.86.70.64"
      },
      {
        "id": "",
        "name": "166.0.187.252"
      },
      {
        "id": "",
        "name": "166.0.187.245"
      },
      {
        "id": "",
        "name": "166.0.187.243"
      },
      {
        "id": "",
        "name": "166.0.187.242"
      },
      {
        "id": "",
        "name": "166.0.187.241"
      },
      {
        "id": "",
        "name": "166.0.187.240"
      },
      {
        "id": "",
        "name": "166.0.187.237"
      },
      {
        "id": "",
        "name": "166.0.187.236"
      },
      {
        "id": "",
        "name": "166.0.187.235"
      },
      {
        "id": "",
        "name": "166.0.187.233"
      },
      {
        "id": "",
        "name": "166.0.187.231"
      },
      {
        "id": "",
        "name": "166.0.187.199"
      },
      {
        "id": "",
        "name": "166.0.187.183"
      },
      {
        "id": "",
        "name": "162.252.175.233"
      },
      {
        "id": "",
        "name": "162.252.172.59"
      },
      {
        "id": "",
        "name": "162.252.172.223"
      },
      {
        "id": "",
        "name": "162.252.172.167"
      },
      {
        "id": "",
        "name": "162.252.172.158"
      },
      {
        "id": "",
        "name": "162.252.172.109"
      },
      {
        "id": "",
        "name": "162.252.172.155"
      },
      {
        "id": "",
        "name": "162.216.243.210"
      },
      {
        "id": "",
        "name": "158.255.213.49"
      },
      {
        "id": "",
        "name": "158.255.213.227"
      },
      {
        "id": "",
        "name": "158.255.213.192"
      },
      {
        "id": "",
        "name": "158.255.213.185"
      },
      {
        "id": "",
        "name": "158.255.213.168"
      },
      {
        "id": "",
        "name": "155.138.238.169"
      },
      {
        "id": "",
        "name": "158.255.213.154"
      },
      {
        "id": "",
        "name": "151.236.22.36"
      },
      {
        "id": "",
        "name": "151.236.22.149"
      },
      {
        "id": "",
        "name": "151.236.16.98"
      },
      {
        "id": "",
        "name": "151.236.16.38"
      },
      {
        "id": "",
        "name": "151.236.16.245"
      },
      {
        "id": "",
        "name": "151.236.16.24"
      },
      {
        "id": "",
        "name": "151.236.16.236"
      },
      {
        "id": "",
        "name": "151.236.16.226"
      },
      {
        "id": "",
        "name": "151.236.16.220"
      },
      {
        "id": "",
        "name": "151.236.16.22"
      },
      {
        "id": "",
        "name": "151.236.16.213"
      },
      {
        "id": "",
        "name": "151.236.16.193"
      },
      {
        "id": "",
        "name": "151.236.16.149"
      },
      {
        "id": "",
        "name": "151.236.16.138"
      },
      {
        "id": "",
        "name": "151.236.16.128"
      }
    ],
    "intrusion_sets": [
      {
        "id": "86adf1b7-c587-499f-bc74-cbf816cf8459",
        "name": "Earth Koshchei",
        "slug": "earth-koshchei"
      }
    ],
    "attack_patterns": [
      {
        "id": "21fd9920-9bc7-4ba5-8cdd-3022c0ef4e9d",
        "name": "T1584.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "0ca071fb-4f52-4672-b64a-75deff57d874",
        "name": "T1048"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "Netherlands"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Energy"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/l/earth-koshchei/IOClist-EarthKoshchei.txt",
    "https://www.trendmicro.com/en_no/research/24/l/earth-koshchei.html",
    "https://otx.alienvault.com/pulse/6761a4b9130d14f22c9acb92"
  ]
}