NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies

NightEagle, also tracked as APT-Q-95, has expanded its operations against Russian businesses with a campaign built around stolen VPN credentials, a Microsoft Exchange backdoor, and covert remote-access routes.

The activity shows how an intruder can turn everyday administration features and publicly available code into a path through a corporate network. The group has been active since at least 2023 and previously concentrated on organizations in Asia.

In the newly documented incidents, it entered corporate VPNs with valid compromised accounts, then worked to gain deeper access, maintain control, and reach critical identity systems. Securelist analysts identified the campaign after investigating several incidents.

Kaspersky said in a report shared with Cyber Security News (CSN) that NightEagle paired the GhostContainer backdoor with tunnel tools to keep access while avoiding the obvious signs created by opening new external ports.

The danger is not confined to a single malicious file or one exposed service. By combining a server-side backdoor, remote desktop connections, credential theft, and Active Directory abuse, the operators could move from one compromised machine to the systems that manage a company’s users and permissions.

NightEagle Hackers Abuse Microsoft Dev Tunnels

The attack commonly began with a successful VPN login using stolen credentials. The source connections came from Russian IP addresses associated with Cloudflare WARP tunnels and from European virtual infrastructure providers, blending the first stage into traffic that may not immediately look hostile.

On Microsoft Exchange servers, the attackers deployed GhostContainer, a .NET backdoor assembled from public components. It includes elements connected to the Neo-reGeorg tunnel, code for CVE-2020-0688, and the GhostWebShell class.

Researchers could not confirm delivery, but assessed that the attackers likely extracted Exchange cryptographic keys, altered VIEWSTATE, and launched the payload in memory.

GhostContainer can receive commands through Exchange web headers, weaken Windows scanning and event logging, and redirect network traffic. This makes a mail server a concealed relay inside the victim environment.

The pattern adds urgency to Exchange server exposure concerns, especially where internet-facing systems are not closely watched.

After obtaining sufficient privileges, the operators used Microsoft Dev Tunnels to publish the compromised system’s RDP service through tunnel-service addresses.

They then combined it with rdp2tcp, an open-source utility that carries TCP traffic through an existing RDP connection. That pairing helps the attackers retain a route into the network without creating a conspicuous new listening port.

It also reflects a broader trend previously seen in earlier Dev Tunnels abuse, where a legitimate developer feature is repurposed for concealed command-and-control traffic rather than testing.

Lateral Movement and Detection

The attackers hosted compressed toolsets in GitHub repositories whose names and archive labels were made to appear legitimate. Files inside were also disguised as familiar software.

They used the atexec tool to create scheduled tasks and Windows port-forwarding rules, extending their reach through normal system functions.

NightEagle then targeted Active Directory, the service that controls accounts and permissions across many Windows networks.

In one incident, it exploited BlueKeep, CVE-2019-0708, to create a local account and place it in the Administrators and Remote Desktop Users groups. Organizations should treat patching and exposed RDP port risks as linked priorities.

The group also requested Kerberos tickets with an unusual set of flags, then attempted DCSync after gaining a sufficiently privileged account.

DCSync imitates a domain controller to request password material from Active Directory. Successful use can give an attacker long-lived access and control of the domain, as explained in understanding DCSync credential theft.

Defenders should investigate unusual VPN logins, unauthorized tunnel-service DNS lookups, new scheduled tasks, suspicious Exchange memory activity, and RDP virtual-channel events 132 and 148 containing rdp2tcp or unexpected random names.

They should promptly patch vulnerable systems, protect VPN accounts with strong multi-factor authentication, restrict remote access, and watch for abnormal directory replication requests.

The campaign demonstrates that familiar tools do not make an intrusion harmless. Careful monitoring of identity, Exchange, RDP, and network forwarding activity can reveal the chain before attackers turn a foothold into broad control of the organization.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC