APT Groups Target Construction Firms to Steal RDP, SSH, and Citrix Credentials

GBHackers reports that APT groups and other sophisticated cyber actors are targeting construction firms to steal RDP, SSH and Citrix credentials, exploiting the sector’s rapid digitalisation. The piece notes nation‑state actors from China, Russia, Iran and North Korea are leveraging IoT, BIM and cloud platforms to gain persistent access and exfiltrate data, with ransomware, supply‑chain attacks and social engineering used to disrupt projects.

It cites that threat actors have identified initial network access as a critical entry point and that pre‑breached credentials are bought from underground forums and dark web marketplaces, including credentials for VPN, RDP, SSH, Citrix, SMTP and FTP. Once inside, attackers exfiltrate high‑value data such as architectural blueprints, project contracts and employee or subcontractor information.

The article, dated 10 November 2025, also highlights social engineering tactics aimed at on‑site personnel and calls for stronger contractual cybersecurity requirements, third‑party risk assessments and real‑time monitoring as mitigations, according to Rapid7.