NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
Kaspersky's Securelink analysts, via Securelist, documented NightEagle (APT-Q-95) attacks on Russian companies that begin with VPN logins using stolen valid credentials from Cloudflare WARP and European infrastructure. On Exchange servers the group deployed GhostContainer, a .NET backdoor built from public components including Neo-reGeorg tunneling, CVE-2020-0688 logic, and the GhostWebShell class, controlled through Exchange web headers. The operators exposed RDP through Microsoft Dev Tunnels paired with rdp2tcp, staged tools in GitHub repositories, and exploited BlueKeep (CVE-2019-0708) to create admin accounts before running DCSync against Active Directory.
- Initial access via stolen VPN credentials from WARP tunnels and European VPS
- GhostContainer .NET backdoor on Exchange embeds Neo-reGeorg, CVE-2020-0688, GhostWebShell
- Microsoft Dev Tunnels and rdp2tcp expose RDP without conspicuous new listening ports
- BlueKeep (CVE-2019-0708) exploited to create local admin accounts; DCSync harvests credentials
- Toolsets hosted in GitHub repositories disguised as legitimate software
- ATT&CK
- T1078 Valid AccountsT1505.003 Web ShellT1572 Protocol TunnelingT1210 Exploitation of Remote ServicesT1003.006 DCSync
- Products
- Microsoft Exchange
- Threat actors
- NightEagleAPT-Q-95
- Organizations
- Securelist
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1dcafb7f8448683281106b06dd22409a | of compromise (IoCs):- Type Indicator Description MD5 hash 1dcafb7f8448683281106b06dd22409a Associated with AdobeSync.exe MD5 hash 1f3034b706c78b35d8e3 |
| md5 | 1f3034b706c78b35d8e34044e68c693a | 683281106b06dd22409a Associated with AdobeSync.exe MD5 hash 1f3034b706c78b35d8e34044e68c693a Associated with adobe_32.exe MD5 hash 3ecd1cd627d0340c92901 |
| md5 | 3ecd1cd627d0340c92901a478a7caad8 | 78b35d8e34044e68c693a Associated with adobe_32.exe MD5 hash 3ecd1cd627d0340c92901a478a7caad8 Associated with App_Web_Container_1.dll MD5 hash 631fb131a5 |
| md5 | 4aa9fb1bf9223dfcdac920759bc7a3c7 | ed73e876ab Associated with App_Web_Container_1.dll MD5 hash 4aa9fb1bf9223dfcdac920759bc7a3c7 Associated with 1c-office-plugin.exe , 1cbroker.exe , and t |
| md5 | 631fb131a56caf4ca0f287ed73e876ab | 478a7caad8 Associated with App_Web_Container_1.dll MD5 hash 631fb131a56caf4ca0f287ed73e876ab Associated with App_Web_Container_1.dll MD5 hash 4aa9fb1bf9 |
From the original article
4 min read at cybersecuritynews.com
NightEagle, also tracked as APT-Q-95, has expanded its operations against Russian businesses with a campaign built around stolen VPN credentials, a Microsoft Exchange backdoor, and covert remote-access routes. The activity shows how an intruder can turn everyday administration features and publicly available code into a path through a corporate network. The group has been active […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.