NightEagle cyberespionage group expands operations to Russian companies

Summary

Kaspersky says NightEagle, also known as APT-Q-95, targeted Russian companies using stolen VPN credentials, Exchange servers and the GhostContainer backdoor. The number of victims is unknown, and attribution remains uncertain.

Key points

Kaspersky investigated several incidents involving NightEagle at Russian businesses but did not name the companies or disclose the number affected.
In most cases, attackers reportedly gained network access using stolen credentials through VPNs.
The group installed the GhostContainer backdoor on Microsoft Exchange servers for remote control and stealth; Kaspersky could not determine exactly how it was planted.
Researchers believe the attackers may have used a previously observed technique involving Exchange encryption keys and in-memory execution.
NightEagle used GitHub repositories disguised with names such as AdobeSync and TrueConf to store hacking tools and related files.
The attackers exploited Active Directory to gain privileges, move laterally, steal credentials and attempt to compromise domain controllers.
The group’s motivation is unspecified, and attribution remains uncertain; earlier claims linking it to North America have not been independently confirmed. The article says the group previously targeted sensitive Chinese industries.

Article Details

Event Type: Cyberespionage operations expanded from China to Russian companies, involving stolen VPN credentials, backdoor deployment on Microsoft Exchange servers, and attempts to compromise domain controllers.
Impact: The attackers gained access to corporate networks, installed GhostContainer for remote control and stealth, moved laterally, stole credentials, and attempted to compromise domain controllers. Kaspersky did not identify the targeted Russian companies or disclose how many organizations were affected.