Remote Desktop Protocol (RDP) attack (RDStealer) | June 21, 2023
Channel: Hacking Space Frontier
Date: 2023-06-21

According to a warning from cybersecurity firm Bitdefender, a state-sponsored espionage campaign has been using new custom malware to monitor remote desktop protocol (RDP) connections and infect connecting clients with a backdoor. The campaign, which started in early 2022, is believed to be aligned with China-based threat actors. Bitdefender identified two custom tools written in the Go programming language, namely the Logutil backdoor and the RDStealer malware. The threat actor has been active since at least 2020, initially using off-the-shelf malware and later transitioning to custom malware like RDStealer. RDStealer is capable of capturing clipboard contents, logging keystrokes, and harvesting data from infected machines. It also has the ability to monitor RDP connections and infect clients that have client drive mapping (CDM) enabled. RDStealer notifies the command-and-control server, exfiltrates data from the connecting client, and deploys the Logutil backdoor. The backdoor uses DLL sideloading techniques to avoid detection and establishes persistence on infected systems. It communicates with the command-and-control server to execute commands, download/upload files, and list folders.