Pawn Storm Uses Brute Force and Stealth Against High-Value Targets | Trend Micro (US)

Pawn Storm (also tracked as APT28/Forest Blizzard) continues aggressive and persistent targeting of high-value government, defense, energy, and infrastructure organizations worldwide by combining large-scale brute-force credential probing with stealthier post-compromise techniques. The report details use of anonymization layers (commercial VPNs, Tor, compromised EdgeOS routers), spear-phishing deliveries including CVE-2023-23397 (Outlook) Net-NTLMv2 hash relay attacks and a WinRAR exploit, example scripts and captures that exfiltrate Net-NTLMv2 blobs, a standalone information stealer that exfiltrates files via free file hosts and TinyURL aliases, and provides IOCs and detection guidance for defenders.