hacker-news Sep 16, 2026 · Crawled Sep 17, 2026

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

5 IoCs 2 Actors

AI Summary

Three distinct threat groups—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises using backdoors, ransomware, and wipers. NightEagle exploits vulnerabilities like CVE-2019-0708 and CVE-2020-0688 to deploy the GhostContainer backdoor on Microsoft Exchange servers, enabling code execution and lateral movement. Hacking Cat, a pro-Ukrainian hacktivist group, uses Gorilla RAT and multiple variants of Monkey ransomware written in different languages, along with wiper malware Nemo Wiper, often in collaboration with other groups. Toy Ghouls has shifted to custom tools, deploying a new backdoor called Bird Agent that uses HiveMQ MQTT or Element (Matrix) for C2 communication, delivered via WinRM using tools like Evil-WinRM.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor NightEagle → Threat Actor Bearlyfy →

Indicators of Compromise 5 extracted

Type	Value	Detail
Domain	api[.]ipify[.]org	Details →
Domain	ipapi[.]co	Details →
Filename	config.toml	Details →
GitHub Repo	ysoserial	Details →
GitHub Repo	Neo-reGeorg	Details →

MITRE ATT&CK TTPs 28 techniques

T1021.001 Remote Desktop Protocol · Lateral Movement T1055.001 Dynamic-link Library Injection · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1133 External Remote Services · Persistence T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1550.002 Pass the Hash · Defense Evasion T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1573 Encrypted Channel · Command And Control T1589 Gather Victim Identity Information · Reconnaissance T1589.001 Credentials · Reconnaissance T1595 Active Scanning · Reconnaissance T1595.002 Vulnerability Scanning · Reconnaissance T1003 OS Credential Dumping · Credential Access T1018 Remote System Discovery · Discovery T1021 Remote Services · Lateral Movement T1048 Exfiltration Over Alternative Protocol · Exfiltration T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1486 Data Encrypted for Impact · Impact