Researchers have discovered 193 remote desktop protocol (RDP) proxy servers provisioned as part of a malicious attack likely orchestrated by the Russian threat actor Midnight Blizzard (APT 29). The attacks are spear-phishing campaigns targeting government and military organizations, IT providers, telecommunications, and cybersecurity companies in countries such as the U.S., France, Australia, Ukraine, Israel, and Germany. The goal of the campaign is to lure victims into running a malicious RDP configuration file, which when opened instructs the victim to connect to an RDP server with a legitimate looking hostname. In order to minimize suspicious warnings and the need for user interactions common with RDP sessions, the attacks use a man-in-the-middle (MiTM) proxy in front of the rogue RDP servers using the Python Remote Desktop Protocol MitM tool PyRDP. The setup enables the attacker to pose as a legitimate RDP server to the victim while deploying malicious scripts, accessing the victim file system, and modifying files. The PyRDP proxy allows attackers to extract sensitive data from the victim system such as passwords, files, and data from shared drives without alerting the victim. This campaign is an example of how attackers can compromise machines without installing malware. Organizations should ensure they have controls in place for unauthorized RDP usage and educate users against running RDP configuration files received via email. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.