PyRDP And Rogue RDP: Automating Malicious RDP Exploits
Rogue RDP campaigns use tools like PyRDP to automate file exfiltration and clipboard theft. This technique enables stealthy espionage operations via compromised remote desktop sessions
A valid Windows service for facilitating communication between a Terminal Server and a Terminal Server Client is called Remote Desktop Protocol (RDP)
The Google Threat Intelligence Group (GTIG) discovered a new phishing effort in October 2024 that was linked to UNC5837, a suspected espionage actor with ties to Russia
Evidence points to the possible automation of harmful tasks including file exfiltration and clipboard collection through the use of an RDP proxy program like PyRDP
PyRDP is an open-source, Python-based man-in-the-middle (MiTM) RDP proxy toolkit. Its automation capabilities make it a viable weapon for such attacks, even though its usage in the reported campaign has not been verified
It is crucial to remember that PyRDP provides fine-grained control over the built-in features rather than taking advantage of flaws in the RDP protocol
PyRDP may have been used in the campaign under observation to bypass the user login prompt and show the malicious RemoteApp by giving credentials