NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
NightEagle (APT-Q-95) expanded operations to Russian targets, using compromised VPN credentials and the GhostContainer .NET implant on Microsoft Exchange. The campaign involved exploiting BlueKeep (CVE-2019-0708) to gain initial access and attempting DCSync operations to compromise Active Directory domain controllers. The group used Microsoft Dev Tunnels and rdp2tcp to tunnel RDP traffic covertly.
- NightEagle used compromised VPN credentials and GhostContainer to compromise Russian organizations.
- Attackers exploited BlueKeep (CVE-2019-0708) and attempted DCSync to target Active Directory domain controllers.
- Lateral movement utilized GitHub-hosted archives and Microsoft Dev Tunnels to tunnel RDP traffic.
- ATT&CK
- T1133 External Remote ServicesT1557 Adversary-in-the-MiddleT1210 Exploitation of Remote ServicesT1003.006 OS Credential Dumping: DCSyncT1021 Remote Services
- Vendors
- Kaspersky
- Threat actors
- NightEagleAPT-Q-95
- Victims
- Russian organizations
- Organizations
- APT-Q-95NightEagleKaspersky
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1f3034b706c78b35d8e34044e68c693a | of compromise dcafb7f8448683281106b06dd22409a AdobeSync.exe 1f3034b706c78b35d8e34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56ca |
| md5 | 3ecd1cd627d0340c92901a478a7caad8 | AdobeSync.exe 1f3034b706c78b35d8e34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll No |
| md5 | 631fb131a56caf4ca0f287ed73e876ab | 34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll Note: IP addresses and domains are |
From the original article
3 min read at gbhackers.com
NightEagle, an espionage-focused threat group also tracked as APT-Q-95, has expanded its operations from Asian targets to Russian organizations, using a layered intrusion chain that culminates in attempts to compromise Active Directory domain controllers. The campaign illustrates a familiar but dangerous enterprise compromise pattern: attackers do not need a novel zero-day exploit when exposed remote […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.