NightEagle targets Russian companies

NightEagle (APT-Q-95), an advanced persistent threat group active since at least 2023, has expanded its targeting to include Russian organizations. The group initially gains access using compromised credentials and leverages Cloudflare WARP tunnels and European VPS infrastructure. They deploy a .NET-based backdoor called GhostContainer on Microsoft Exchange servers, exploiting CVE-2020-0688 and utilizing cryptographic key extraction from ASP.NET configurations. The backdoor enables command-and-control communication and traffic redirection via proxying. Attackers use legitimate tools such as Microsoft dev tunnels, rdp2tcp, and Impacket utilities for lateral movement and persistence, including exploitation of CVE-2019-0708 (BlueKeep) and DCSync attacks in Active Directory.

AI-extracted · verify before operational use