NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
Kaspersky's Global Emergency Response Team investigated NightEagle (APT-Q-95) incidents over the past year, finding the group—active since at least 2023 and formerly focused on Asia—now targeting Russian businesses. Attackers used compromised VPN credentials and deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, built from Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial's GhostWebShell, injected in memory via VIEWSTATE manipulation with AMSI bypass. For lateral movement they combined Microsoft dev tunnels with rdp2tcp over RDP, exploited BlueKeep (CVE-2019-0708) to create local admin accounts, and performed DCSync replication against Active Directory.
- Initial access via compromised VPN credentials; connections traced to Cloudflare WARP tunnels and European virtual infrastructure.
- GhostContainer backdoor on Exchange combines Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial GhostWebShell, bypassing AMSI.
- Lateral movement via RDP using Microsoft dev tunnels and rdp2tcp, with tools hosted on disguised GitHub repositories.
- Exploited BlueKeep (CVE-2019-0708) and performed DCSync to replicate domain credentials.
- ATT&CK
- T1078 Valid AccountsT1505.003 Web ShellT1021.001 Remote Desktop ProtocolT1572 Protocol TunnelingT1003.006 DCSync
- Threat actors
- NightEagleAPT-Q-95
- Malware
- GhostContainer
- Organizations
- Kaspersky
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1dcafb7f8448683281106b06dd22409a | ateral movement across the network Indicators of compromise 1dcafb7f8448683281106b06dd22409a AdobeSync.exe 1f3034b706c78b35d8e34044e68c693a adobe_32.exe |
| md5 | 1f3034b706c78b35d8e34044e68c693a | f compromise 1dcafb7f8448683281106b06dd22409a AdobeSync.exe 1f3034b706c78b35d8e34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56ca |
| md5 | 3ecd1cd627d0340c92901a478a7caad8 | AdobeSync.exe 1f3034b706c78b35d8e34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll 4a |
| md5 | 4aa9fb1bf9223dfcdac920759bc7a3c7 | d8 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll 4aa9fb1bf9223dfcdac920759bc7a3c7 1c-office-plugin.exe, 1cbroker.exe, trueconf.exe https://gi |
| md5 | 631fb131a56caf4ca0f287ed73e876ab | 34044e68c693a adobe_32.exe 3ecd1cd627d0340c92901a478a7caad8 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll 4aa9fb1bf9223dfcdac920759bc7a3c7 1c |
From the original article
5 min read at securelist.com
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.
By Stanislav Larinsky, Kaspersky Security Services · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.