Kaspersky Details Three Groups’ Attacks on Russian Enterprises
Summary
Kaspersky describes NightEagle, Hacking Cat, and Toy Ghouls campaigns targeting Russian enterprises, detailing their access methods, lateral movement, ransomware and wiper activity, and custom backdoors.
Key points
- Kaspersky says NightEagle used compromised VPN credentials to access corporate networks and exploited Active Directory vulnerabilities for privilege escalation and lateral movement.
- NightEagle deployed GhostContainer on Microsoft Exchange servers; the backdoor can enable remote access, code execution, file operations, and tunneling. Its delivery method is unknown.
- Hacking Cat reportedly used Exchange vulnerabilities to deliver Gorilla RAT and Monkey ransomware variants targeting Windows, Linux, and VMware ESXi.
- Some Monkey variants reportedly lack a stored encryption key, making recovery impossible and functioning as wipers despite leaving ransom notes; other variants include credential theft and recovery-disabling features.
- Kaspersky says Hacking Cat collaborated with other groups to deploy ClearWater ransomware and Nemo Wiper. Hacking Cat disputed some of the tool attribution, saying some tools were its own but the lockers were not.
- Toy Ghouls deployed custom Bird Agent backdoors using HiveMQ MQTT or Element for command-and-control; the malware can execute commands and establish persistence as a Windows service.
Article Details
- Attack Vectors
- NightEagle used compromised valid credentials to access corporate VPNs.
- NightEagle deployed GhostContainer to Microsoft Exchange servers; the exact delivery method is unknown. Kaspersky said attackers may have extracted cryptographic keys from ASP.NET configuration, overwritten the VIEWSTATE parameter, and injected a payload.
- NightEagle used tunneling tools, including Microsoft dev tunnels and rdp2tcp, to redirect traffic over RDP and access internal systems.
- NightEagle exploited Active Directory vulnerabilities, including CVE-2019-0708, and attempted a DCSync attack.
- Hacking Cat exploited vulnerabilities in Exchange servers to deliver Gorilla RAT and used batch scripts to deliver ClearWater.
- Hacking Cat deployed Monkey ransomware variants against Windows, Linux, and VMware ESXi systems; the variants used encryption, persistence, recovery inhibition, and other destructive functions.
- Hacking Cat and the Ukrainian Cyber Alliance deployed Nemo Wiper, which overwrote files with random bytes and filled remaining disk space with randomly named files.
- Toy Ghouls used WinRM with Evil-WinRM and WinRM-fs to deliver Bird Agent backdoors and configuration files.
- Bird Agent communicated through HiveMQ MQTT or Element, fetched commands, and executed them through PowerShell or the Windows command-line interface.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]ipify[.]org | The article says a Monkey ransomware variant queried this service to obtain the public IP address; it does not identify the domain itself as malicious infrastructure. |
| DOMAIN | ipapi[.]co | The article says a Monkey ransomware variant queried this service to obtain the public IP address; it does not identify the domain itself as malicious infrastructure. |
MITRE ATT&CK
T1003.006 · DCSyncNightEagle attempted to impersonate a domain controller using a DCSync attack to obtain domain account password hashes.T1005 · Data from Local SystemA .NET Monkey ransomware variant extracted Microsoft Outlook credentials and sent them to its C2 server.T1021.001 · Remote Desktop ProtocolNightEagle redirected network traffic via RDP using tunneling tools.T1053.005 · Scheduled TaskA C++ Monkey ransomware variant established persistence through a scheduled task.T1059.001 · PowerShellBird Agent's HiveMQ variant executed fetched commands through PowerShell.T1059.003 · Windows Command ShellBird Agent's Element variant executed received commands through the Windows command-line interface.T1070.001 · Clear Windows Event LogsA C++ Monkey ransomware variant cleared system logs.T1078 · Valid AccountsNightEagle used compromised valid credentials to access corporate VPNs and victim resources.T1090 · ProxyGhostContainer could function as a traffic redirection tool or tunnel, and NightEagle used tunnels for internal access.T1485 · Data DestructionNemo Wiper overwrote files with random bytes and filled remaining disk space with files containing random data.T1486 · Data Encrypted for ImpactMonkey ransomware variants encrypted victim files, including with ChaCha20-Poly1305 or AES-256-CBC.T1547.001 · Registry Run Keys / Startup FolderA C++ Monkey ransomware variant established persistence using a RunOnce registry key.T1562.001 · Disable or Modify ToolsMonkey ransomware variants disabled recovery mechanisms and, in one variant, configured Microsoft Defender exclusions.
CVE
CVE-2019-0708This includes the exploitation of CVE-2019-0708 (aka BlueKeep) to create a local account on the system and add it to the Administrators and Remote Desktop Users groups.CVE-2020-0688components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility,” Kaspersky explained.CVE-2021-26855Attacks mounted by the group have weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855 and CVE-2026-42897) to deliver a Go-based remote access trojan dubbed Gorilla RAT, which can tunnel traffic to allowCVE-2026-42897mounted by the group have weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855 and CVE-2026-42897) to deliver a Go-based remote access trojan dubbed Gorilla RAT, which can tunnel traffic to allow the
Threat Actors
BearlyfyThe article lists Bearlyfy as an alternate name for Toy Ghouls.Cyber Anarchy SquadPro-Ukraine hacktivist group reported to collaborate with Hacking Cat, including in delivery of ClearWater.Hacking CatPro-Ukrainian hacktivist entity reported to target Russian enterprises with RATs, ransomware, and wipers.Laboo.booThe article lists Laboo.boo as an alternate name for Toy Ghouls.NightEagleThreat cluster reported by Kaspersky to target Russian enterprises; also identified in the article as APT-Q-95.Toy GhoulsFinancially motivated group reported to target Russian organizations with ransomware and custom Bird Agent backdoors; also identified as Bearlyfy, Laboo.boo, and Feral Wolf.Ukrainian Cyber AlliancePro-Ukrainian hacktivist group reported to collaborate with Hacking Cat in an operation deploying Nemo Wiper.
Malware
Babukorganizations is Toy Ghouls (aka Bearlyfy, Laboo.boo, and Feral Wolf), which has moved from using leaked Babuk and LockBit ransomware builders to its own custom GenieLocker ransomware and now to a bespoke backdoor.Bird AgentThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.ClearWaterThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.GenieLockerFeral Wolf), which has moved from using leaked Babuk and LockBit ransomware builders to its own custom GenieLocker ransomware and now to a bespoke backdoor.GhostContainerThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.Gorilla RATThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.LockBitis Toy Ghouls (aka Bearlyfy, Laboo.boo, and Feral Wolf), which has moved from using leaked Babuk and LockBit ransomware builders to its own custom GenieLocker ransomware and now to a bespoke backdoor.MonkeyThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.Nemo WiperThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.
Vendors
Products
Cloudflare WARP“VPN connections originated from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from IP addresses associated with European virtual infrastructure providers.”ElementToy Ghouls introduced custom Bird Agent backdoors using HiveMQ MQTT and Matrix Element for command-and-control.HiveMQToy Ghouls introduced custom Bird Agent backdoors using HiveMQ MQTT and Matrix Element for command-and-control.LinuxHacking Cat deployed Gorilla RAT and multiple Monkey ransomware variants against Windows, Linux, and ESXi systems.Microsoft Active DirectoryThe campaigns use tools such as GhostContainer, Gorilla RAT, Monkey ransomware, ClearWater, Nemo Wiper, and Bird Agent to compromise Microsoft Exchange, Active Directory, and other enterprise systems.Microsoft Defender Antimalware Platformand Windows Command Prompt, bypass AMSI, turn off Event Tracing for Windows (ETW), configure Microsoft Defender exclusions for the encryptor, make Registry modifications to disable Task Manager and WindowsMicrosoft Exchange Servera known modular backdoor that grants the operators complete access to a victim’s Microsoft Exchange Server, as well as run arbitrary code, perform file operations, and load additional modules.Microsoft OutlookIt’s equipped to escalate privileges and disable Windows recovery mechanisms, extract Microsoft Outlook credentials and send them to the C2 server, delete files with .bak, .backup, .bkf, .bck extensions, and removeMicrosoft WindowsHacking Cat deployed Gorilla RAT and multiple Monkey ransomware variants against Windows, Linux, and ESXi systems.VMware ESXiAlso delivered by the threat actor are multiple variants of a ransomware family dubbed Monkey that are written in Rust, .NET, C++, and Golang to target Windows, Linux, and VMware ESXi systems.
Tools
Evil-WinRM“The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this.”Microsoft dev tunnelsTo move laterally within the internal network, NightEagle has been observed downloading tunneling tools to redirect network traffic via RDP using Microsoft dev tunnels and an open-source program called rdp2tcp.Neo-reGeorg“It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility,” Kasperskyrdp2tcpTo move laterally within the internal network, NightEagle has been observed downloading tunneling tools to redirect network traffic via RDP using Microsoft dev tunnels and an open-source program called rdp2tcp.WinRM-fs“The group relies on open-source tools such as Evil-WinRM and WinRM-fs to do this.”ysoserialtunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility,” Kaspersky explained.
Countries
RussiaEnterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky.UkraineHacking Cat has also been observed teaming up with the Cyber Anarchy Squad, another pro-Ukraine hacktivist group, to deliver a different ransomware strain known as ClearWater by means of a batch script.