NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks.

Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously concentrated on organizations across Asia.

The newly investigated intrusions show a shift in the group’s geographic targeting and an increasingly mature tradecraft designed to preserve covert access to enterprise environments.

NightEagle typically obtained initial access through compromised but valid corporate VPN credentials.

Using legitimate credentials reduces the chance that the initial login is immediately flagged as malicious, especially where multi-factor authentication, behavioral analytics, and VPN access controls are weak or inconsistently applied.

A central feature of the campaign is the deployment of the GhostContainer backdoor on Microsoft Exchange servers.

GhostContainer is a .NET-based implant designed to blend into Exchange and ASP.NET activity while providing command execution, proxying, socket forwarding, and payload-loading capabilities.

The malware combines elements adapted from publicly available projects, including Neo-reGeorg, the ExchangeCmdPy.py proof-of-concept associated with CVE-2020-0688, and GhostWebShell-related functionality from ysoserial.

This approach enables the operators to assemble a modular post-exploitation toolkit without relying entirely on custom malware code.

Earlier analysis found the implant’s components can process attacker commands, download files, launch commands, execute shellcode, and load additional .NET code.

Researchers could not confirm the exact delivery method used in the Russian incidents.

However, the activity is consistent with a known Exchange abuse technique: attackers extract ASP.NET cryptographic keys from the server configuration, manipulate the __VIEWSTATE parameter, and inject an in-memory payload that starts GhostContainer without requiring a conventional web shell file on disk.

GhostContainer’s Stub component receives encrypted command data through the x-owa-urlpostdata HTTP header.

It also attempts to neutralize security visibility by altering memory associated with the Antimalware Scan Interface and Windows Event Log functions.

Its traffic-forwarding module can create a covert bridge between the internet and internal systems, effectively turning a compromised Exchange server into an access point for deeper intrusion activity.

After gaining higher privileges, the operators used Remote Desktop Protocol to move laterally and downloaded tunneling utilities from GitHub repositories disguised as legitimate software resources.

Archived files and executables used names resembling Adobe, TrueConf, and 1C-related products, likely to appear benign during cursory review.

Kaspersky Researchers said that, connections originating from Russian IP space associated with Cloudflare WARP tunnels, alongside addresses tied to European virtual private server providers.

NightEagle Abuse Microsoft Dev Tunnels

The attackers paired Microsoft Dev Tunnels with the open-source rdp2tcp utility.

Microsoft Dev Tunnels can expose locally hosted services through *.devtunnels.ms domains; in this campaign, the capability was used to publish RDP access on port 3389. Meanwhile, rdp2tcp tunnels TCP traffic inside an established RDP session.

This combination is significant because it allows NightEagle to sustain access without opening conspicuous new inbound ports.

Defenders should examine DNS queries to devtunnels.ms, unexpected RDP exposure, and Remote Desktop Services operational logs for virtual-channel events.

Event IDs 132 and 148 containing rdp2tcp, or unusual random channel names, may indicate tunneled traffic.

NightEagle also used Impacket’s atexec utility to create scheduled tasks and configured Windows port forwarding with netsh interface portproxy.

In one incident, the group exploited CVE-2019-0708, known as BlueKeep, to create a local account and add it to the Administrators and Remote Desktop Users groups.

The operators further targeted Active Directory by requesting Kerberos tickets with unusual Forwardable, Proxiable, and Renewable flag combinations and attempting DCSync replication after obtaining privileged credentials.

Successful DCSync activity can expose domain password hashes and enable an attacker to impersonate a domain controller, placing the entire Active Directory environment at risk.

Organizations running on-premises Exchange should urgently review VPN logins, restrict administrative RDP access, patch legacy systems vulnerable to BlueKeep, and investigate anomalous ASP.NET and Exchange request behavior.

Monitoring for suspicious __VIEWSTATE activity, x-owa-urlpostdata headers, unexpected .NET assembly loading, netsh portproxy changes, and Dev Tunnels traffic can help expose the attack chain.

GhostContainer has previously been linked to attacks against high-value Asian organizations, where researchers described it as a customized Exchange-focused implant capable of proxying traffic and extending functionality through additional modules.  

The Russian campaign demonstrates that NightEagle is adapting those capabilities for wider espionage-oriented operations, with Exchange servers and Active Directory remaining the most critical defensive choke points.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC