Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Kaspersky reports the NightEagle espionage group (APT-Q-95) expanded from China-focused targets to Russian companies, backdooring Microsoft Exchange servers with GhostContainer using stolen VPN credentials.
Kaspersky investigated several incidents over the past year at Russian businesses attributed to NightEagle (APT-Q-95), a group active since at least 2023 and previously focused on Chinese defense, semiconductor, AI, and quantum technology targets. Hackers used stolen credentials to access corporate networks through VPNs, targeted Microsoft Exchange servers, and installed the GhostContainer backdoor, believed deployed by extracting Exchange encryption keys and executing the payload in memory via Microsoft's web application framework. The group stored hacking tools in GitHub repositories disguised as legitimate software such as AdobeSync and TrueConf, exploited Active Directory weaknesses for privilege escalation and lateral movement, and targeted domain controllers. Attribution remains uncertain; Chinese researchers previously associated the group with North America.
- NightEagle active since at least 2023, previously targeting Chinese defense, semiconductor, AI, and quantum organizations
- GhostContainer backdoor on Exchange servers evades Windows security logging and redirects network traffic
- GitHub repositories disguised as legitimate software (AdobeSync, TrueConf) store hacking tools
- Active Directory weaknesses exploited for privilege escalation, lateral movement, and domain controller compromise
- Attribution uncertain; Chinese researchers previously associated the group with North America
- ATT&CK
- T1078 Valid AccountsT1133 External Remote ServicesT1505.003 Web ShellT1105 Ingress Tool TransferT1003 OS Credential Dumping
- Threat actors
- NightEagleAPT-Q-95
- Malware
- GhostContainer
From the original article
2 min read at therecord.mediaOver the past year, Russian cybersecurity firm Kaspersky said it investigated several incidents involving the group at Russian businesses.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.