Full Report
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.
Analysis Summary
# Threat Actor: NightEagle
## Attribution & Identity
- **Name:** NightEagle
- **Aliases:** APT-Q-95
- **Known Associations:** The actor utilizes components from several open-source projects including Neo-reGeorg, the ysoserial utility, and rdp2tcp.
- **Identity:** While specific state attribution is not explicitly confirmed in this report, the actor is identified as a sophisticated APT (Advanced Persistent Threat) active since at least 2023.
## Activity Summary
NightEagle has recently targeted Russian enterprises using advanced techniques for persistence and lateral movement. The campaigns involve gaining initial access via compromised valid credentials to connect to corporate VPNs, followed by the deployment of the GhostContainer backdoor on Microsoft Exchange Servers. The actor focuses on deep infrastructure compromise, specifically targeting Active Directory to gain long-term control.
## Tactics, Techniques & Procedures
- **Initial Access:** Use of compromised valid credentials to access corporate VPNs.
- **Persistence:** Deployment of **GhostContainer**, a modular backdoor that masquerades as a common server component and operates in-memory.
- **Lateral Movement:**
- Use of **Microsoft Dev Tunnels** to redirect network traffic.
- Use of **rdp2tcp** for tunneling via RDP.
- **Credential Access:** **DCSync attacks** used to impersonate domain controllers and extract password hashes.
- **Defense Evasion:** Use of Cloudflare WARP tunnels and European virtual infrastructure to hide source IP addresses; in-memory payload execution.
- **Privilege Escalation:** Exploitation of Active Directory vulnerabilities and RDP flaws.
- **MITRE ATT&CK IDs:**
- **T1078** (Valid Accounts)
- **T1133** (External Remote Services)
- **T1021.001** (Remote Services: Remote Desktop Protocol)
- **T1210** (Exploitation of Remote Services)
- **T1003.006** (OS Credential Dumping: DCSync)
- **CVE-2019-0708** (BlueKeep)
- **CVE-2020-0688** (Microsoft Exchange Validation Key Vulnerability)
## Targeting
- **Sectors:** Government, High-Tech, and general Enterprises.
- **Geography:** Russia (primary recent focus), Asia.
- **Victims:** Russian enterprises; previously a government agency and a high-tech company in Asia.
## Tools & Infrastructure
- **Malware:**
- **GhostContainer:** Modular backdoor (incorporates GhostWebShell class).
- **Neo-reGeorg:** Tunneling tool.
- **Infrastructure:**
- Cloudflare WARP tunnels.
- European VPS/Virtual infrastructure providers.
- Microsoft Dev Tunnels (devtunnels[.]ms).
- **Public Tools:** ysoserial, rdp2tcp.
## Implications
NightEagle represents a high-tier threat capable of bypassing standard perimeter defenses by using legitimate credentials and tunneling through trusted services like Microsoft Dev Tunnels. Their focus on Active Directory infrastructure and the use of "fileless" backdoors (in-memory) indicates a strategic objective of long-term espionage and total administrative control over victim environments.
## Mitigations
- **Identity Security:** Implement Multi-Factor Authentication (MFA) on all VPN and external remote services to mitigate the use of compromised credentials.
- **Patch Management:** Prioritize patching of Microsoft Exchange Servers (specifically CVE-2020-0688) and legacy RDP vulnerabilities (CVE-2019-0708).
- **Network Monitoring:** Monitor for unusual outbound traffic to known tunneling services and unauthorized use of Microsoft Dev Tunnels within the corporate environment.
- **Active Directory Defense:** Monitor for DCSync activity (DS-Replication-Get-Changes-All permissions) and audit the creation of new accounts in the "Administrators" and "Remote Desktop Users" groups.
- **Defang Links Mentioned:**
- hxxps://github[.]com/V-E-O/rdp2tcp
- hxxps://learn[.]microsoft[.]com/en-us/azure/developer/dev-tunnels/overview