Summary
The foreign threat actor, often posing as a trusted entity, is sending spearphishing emails containing malicious remote desktop protocol (RDP) files to targeted organizations to connect to and access files stored on the target’s network. Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network. Forbid or significantly restrict outbound RDP connections to external or public networks. This measure is crucial for minimizing exposure to potential cyber threats. Block RDP Files in Communication Platforms: Prohibit RDP files from being transmitted through email clients and webmail services.