Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.
- NightEagle uses compromised VPN credentials, GhostContainer Exchange backdoor, and DCSync for domain compromise
- Hacking Cat shifted from defacements to encryption and destructive attacks, collaborating with Cyber Anarchy Squad
- Monkey ransomware variants written in Rust, .NET, C++, and Golang target Windows, Linux, and ESXi
- Some Monkey variants discard the encryption key, acting as wipers while leaving ransom notes
- ATT&CK
- T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1003.006 DCSyncT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Vendors
- Kaspersky
- Products
- Microsoft Exchange
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear | 6.1 | 71% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ipapi.co | btain the public IP address by querying api.ipify[.]org and ipapi[.]co, and disable a number of backup, database, and recovery m |
From the original article
7 min read at thehackernews.com
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.