Russian Threat Groups Exploit RDP, VPN, Supply Chain for Initial Access

Key Takeaways

• Russian state-sponsored threat groups significantly increased their cyber operations in 2025, with a 37.4% rise in incidents compared to the previous year.
• Initial access methods predominantly involved exploiting Remote Desktop Protocol (RDP) and Virtual Private Networks (VPNs), alongside sophisticated supply chain attacks and social engineering.
• Targets included critical sectors such as government, defense, and energy infrastructure, primarily in Ukraine and across Europe.
• The attacks often led to the deployment of destructive wiper malware, ransomware, and long-term espionage tools.
• Organizations are urged to implement robust security measures, including MFA, Zero Trust, patch management, and employee training, to counter these evolving threats.

Russian state-sponsored cyber adversaries dramatically intensified their campaigns in 2025, leveraging a diverse and sophisticated arsenal of tactics to gain initial footholds within target networks. A recent report highlights that these methods frequently centered on exploiting vulnerabilities in Remote Desktop Protocol (RDP) and Virtual Private Networks (VPNs), executing complex supply chain compromises, and deploying highly tailored social engineering operations.

From weaponizing remote access tools and network gateways to subverting trusted software delivery mechanisms and manipulating personnel through deceptive campaigns, these threat actors have cultivated a formidable and adaptable toolkit for penetrating their targets. The findings are detailed in a comprehensive report obtained by Cyber Security News (CSN).

These are not opportunistic attacks but meticulously planned, persistent campaigns targeting governmental entities, defense contractors, energy infrastructure, and other critical sectors, with a particular focus on Ukraine and broader Europe. Noteworthy groups such as UAC-0002 (Sandworm), UAC-0001 (APT28), UAC-0010 (Gamaredon), and UAC-0190 (Void Blizzard) were all actively involved throughout the year.

Analysts from the National Security and Defense Council of Ukraine confirmed a substantial increase in both the volume and sophistication of these attacks in 2025. CERT-UA documented approximately 5,927 cyber incidents, representing a 37.4% surge compared to 2024. The report identifies RDP exploitation, VPN vulnerabilities, and phishing attempts across platforms like Signal, WhatsApp, and Telegram as primary methods for establishing initial network access.

The ramifications of these intrusions extended beyond simple data exfiltration. Numerous breaches resulted in the deployment of destructive wiper malware, ransomware variants, and persistent espionage tools engineered for covert data collection and exfiltration. This extensive activity underscores that these groups function not merely as cybercriminals but as integral components of a broader geopolitical strategy.

In certain instances, attackers streamlined their operations by acquiring stolen credentials from darknet forums, allowing them to bypass traditional phishing and move directly into target environments. This approach significantly reduced the window between initial access and active exploitation.

RDP, VPN, and Supply Chain as Entry Points

Remote Desktop Protocol remained a highly favored entry vector throughout 2025. Groups like UAC-0238 exploited exposed RDP services to deploy ransomware variants such as X2anylock, Warlock, and LockBit 3.0 within compromised systems.

VPN appliances were also heavily targeted, with vulnerabilities including CVE-2025-20333 and CVE-2025-20362 providing attackers with direct conduits into internal networks.

Supply chain attacks introduced another critical layer of risk. Adversaries focused on compromising software update mechanisms, third-party tools, and IT service providers to embed backdoors in environments where security scrutiny might be lower. Once inside, groups deployed malware families such as Remcos RAT, DarkCrystal RAT, XWorm, and Lumma Stealer to maintain persistent access.

Widespread vulnerabilities in platforms like Roundcube (CVE-2024-42009, CVE-2025-49113), Fortinet appliances (CVE-2024-55591, CVE-2024-21762), and archiving utilities like WinRAR and 7-Zip were actively exploited. Furthermore, older Microsoft Office flaws (CVE-2017-11882, CVE-2017-0199) continued to be leveraged, demonstrating that unpatched legacy vulnerabilities still pose significant risks.

Malicious payloads were delivered through various file types, including SVG, PNG, LNK, JS, and HTA files. These were frequently hosted on legitimate services such as Dropbox, Google Drive, and Cloudflare Tunnels to evade conventional network defenses. Attackers also employed “Living off the Land” techniques, utilizing built-in system tools like PowerShell, certutil, mshta.exe, and rundll32 to blend into normal system activity and avoid detection.

Social Engineering and Phishing Campaigns

Social engineering remained a consistently effective method for Russian threat groups to achieve initial access in 2025. Phishing lures were distributed via email platforms, including Microsoft O365, Roundcube, and Zimbra, as well as popular messaging applications like Signal, WhatsApp, and Telegram.

Attackers employed various deceptive techniques, such as ClickFix, fake CAPTCHA prompts, and PowerShell-based execution tricks, to deliver malware without triggering immediate security alerts. OAuth phishing, Device Code phishing targeting Microsoft Teams, and App-Specific Password phishing against Google accounts were observed, impacting over a thousand individuals.

Novel methods included QR-code session hijacking, dubbed GhostPairing, and the distribution of malicious Android APK files outside the Google Play store to infect devices with spyware like CamelSpy.

What You Should Do

• Enforce Multi-Factor Authentication (MFA): Implement MFA across all services and applications, especially for remote access and critical systems.
• Adopt Zero Trust Architecture: Move towards a Zero Trust model, verifying every user and device before granting access, regardless of location.
• Implement Protective DNS: Utilize Protective DNS services to block access to known malicious domains and C2 infrastructure.
• Prioritize Patch Management: Regularly apply security patches and updates for all software and hardware, addressing both new and legacy vulnerabilities, particularly for RDP, VPNs, webmail, and productivity suites.
• Restrict RDP Access: Limit RDP access to only essential personnel and implement strong access controls, including VPN requirements and IP whitelisting.
• Monitor for Unusual Activity: Deploy robust Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) solutions to monitor for unusual use of built-in system tools (e.g., PowerShell, certutil) and suspicious network connections.
• Conduct Regular Security Awareness Training: Educate employees on identifying and reporting social engineering attempts, phishing emails, and suspicious messages across all communication platforms.
• Secure the Supply Chain: Vet third-party vendors and software thoroughly, implement strong software integrity checks, and monitor for unauthorized modifications in software updates.
• Review and Audit Access: Regularly audit user accounts, permissions, and network configurations to ensure least privilege principles are maintained.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.