Threat Actor 🇺🇸 United States
NightEagle
Also known as: APT-Q-95
NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to significant funding, with dedicated infrastructure, and focuses on low-noise, low-impact intelligence gathering operations. NightEagle is identified as a North-American, state-sponsored or affiliated group that has been active since at least 2023.
Indicators of Compromise 18
Domain api[.]ipify[.]org Domain ipapi[.]co Filename 1c-office-plugin.exe Filename 1cbroker.exe Filename AdobeSync.exe Filename App_Web_Container_1.dll Filename adobe_32.exe Filename config.toml Filename trueconf.exe GitHub Repo Neo-reGeorg GitHub Repo browserthemes/resourcepack GitHub Repo mirror-js/mirror-js GitHub Repo ysoserial MD5 1dcafb7f8448683281106b06dd22409a MD5 1f3034b706c78b35d8e34044e68c693a MD5 3ecd1cd627d0340c92901a478a7caad8 MD5 4aa9fb1bf9223dfcdac920759bc7a3c7 MD5 631fb131a56caf4ca0f287ed73e876ab
MITRE ATT&CK TTPs 21
T1021.001 T1055.001 T1059.001 T1071.001 T1078 T1090 T1095 T1105 T1110 T1133 T1485 T1490 T1550.002 T1566 T1566.001 T1570 T1573 T1589 T1589.001 T1595 T1595.002
Remote Desktop Protocol
Lateral Movement
Dynamic-link Library Injection
Defense Evasion
PowerShell
Execution
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
Proxy
Command And Control
Non-Application Layer Protocol
Command And Control
Ingress Tool Transfer
Command And Control
Brute Force
Credential Access
External Remote Services
Persistence
Data Destruction
Impact
Inhibit System Recovery
Impact
Pass the Hash
Defense Evasion
Phishing
Initial Access
Spearphishing Attachment
Initial Access
Lateral Tool Transfer
Lateral Movement
Encrypted Channel
Command And Control
Gather Victim Identity Information
Reconnaissance
Credentials
Reconnaissance
Active Scanning
Reconnaissance
Vulnerability Scanning
Reconnaissance
Source Articles
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Three distinct threat groups—NightEagle, Hacking Cat, and Toy Ghouls—are targeting Russian enterprises using backdoors, ransomware, and wipers. NightEagle exploits vulnerabilities like CVE-2019-0708 and CVE-2020-0688 to deploy the GhostContainer backdoor on Microsoft Exchange servers, enabling code execution and lateral movement. Hacking Cat, a pro-Ukrainian hacktivist group, uses Gorilla RAT and multiple variants of Monkey ransomware written in different languages, along with wiper malware Nemo Wiper, often in collaboration with other groups. Toy Ghouls has shifted to custom tools, deploying a new backdoor called Bird Agent that uses HiveMQ MQTT or Element (Matrix) for C2 communication, delivered via WinRM using tools like Evil-WinRM.
hacker-news ·1mo ago
NightEagle targets Russian companies
NightEagle (APT-Q-95), an advanced persistent threat group active since at least 2023, has expanded its targeting to include Russian organizations. The group initially gains access using compromised credentials and leverages Cloudflare WARP tunnels and European VPS infrastructure. They deploy a .NET-based backdoor called GhostContainer on Microsoft Exchange servers, exploiting CVE-2020-0688 and utilizing cryptographic key extraction from ASP.NET configurations. The backdoor enables command-and-control communication and traffic redirection via proxying. Attackers use legitimate tools such as Microsoft dev tunnels, rdp2tcp, and Impacket utilities for lateral movement and persistence, including exploitation of CVE-2019-0708 (BlueKeep) and DCSync attacks in Active Directory.
securelist ·1mo ago