Full Report
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.
Analysis Summary
# Threat Actor: NightEagle APT
## Attribution & Identity
- **Name:** NightEagle APT
- **Aliases:** Information not explicitly detailed in the summary, but identified by Kaspersky GERT experts as a distinct Advanced Persistent Threat (APT) group.
- **Identity:** A sophisticated threat actor capable of developing custom backdoors and maintaining infrastructure on legitimate platforms like GitHub.
## Activity Summary
- **Recent Campaign:** A new campaign uncovered by Kaspersky GERT experts characterized by the use of a custom backdoor named **GhostContainer**.
- **Operations:** The actor focuses on persistent access and lateral movement within compromised networks, utilizing a combination of novel malware and exploitation of existing administrative services.
## Tactics, Techniques & Procedures
- **Exploitation of Vulnerabilities:** Actively exploits vulnerabilities in **Active Directory** and **Remote Desktop Protocol (RDP)** to gain entry and escalate privileges.
- **Persistence & Backdoors:** Deployment of the **GhostContainer** backdoor for long-term access.
- **Legitimate Service Abuse:** Hosting malicious tools and components on **GitHub** to evade detection and blend with legitimate traffic.
- **Tunneling:** Utilization of tunneling techniques to bypass network security controls (implied by the source URL/context).
*Note: Specific MITRE ATT&CK IDs were not provided in the snippet, but the activities map to:*
- **T1071.001:** Application Layer Protocol: Web Protocols (GitHub)
- **T1133:** External Remote Services (RDP)
- **T1484:** Domain Policy Modification (Active Directory)
## Targeting
- **Sectors:** The provided snippet does not list specific industries, but the focus on Active Directory and RDP suggests targeting of large-scale enterprise environments and corporate networks.
- **Geography:** Not explicitly specified in the summary, though typically APT research of this nature covers global or regional state-sponsored interests.
- **Victims:** Specific organizations were not named in the provided text.
## Tools & Infrastructure
- **Malware:**
- **GhostContainer:** A newly identified custom backdoor.
- **Infrastructure:**
- **GitHub:** Used for hosting tools and potentially as part of the C2/delivery chain.
- **Defanged Infrastructure:** hxxps[://]github[.]com (Used for hosting actor tools).
## Implications
NightEagle APT demonstrates a high level of operational maturity by combining "living-off-the-land" techniques (exploiting RDP/AD) with custom-built malware. The use of GitHub for infrastructure makes detection difficult for traditional perimeter defenses, as traffic to these domains is often whitelisted. Their focus on Active Directory indicates an intent for full domain compromise and long-term intelligence collection.
## Mitigations
- **Strengthen Active Directory Security:** Implement the principle of least privilege, monitor for unauthorized changes to Group Policy Objects (GPOs), and regularly audit high-privilege accounts.
- **Secure Remote Access:** Enforce Multi-Factor Authentication (MFA) on all RDP instances and restrict RDP access via VPN or IP whitelisting.
- **GitHub Monitoring:** Implement security controls to monitor or inspect traffic to code repositories for suspicious downloads or anomalous behavior.
- **Endpoint Detection:** Deploy EDR solutions to identify the execution of unauthorized tools and the specific behavior of the GhostContainer backdoor.
- **Network Segmenting:** Use network segmentation to limit the impact of lateral movement through RDP and AD exploitation.