Threat Actor 🇺🇸 United States

NightEagle

Also known as: APT-Q-95

NightEagle is an advanced Threat Actor that targeted China's High-Tech Industry and Military Organisation, leveraging sophisticated techniques, 0 days, and specialized detection avoiding malware. The threat actor seems to have access to significant funding, with dedicated infrastructure, and focuses on low-noise, low-impact intelligence gathering operations. NightEagle is identified as a North-American, state-sponsored or affiliated group that has been active since at least 2023.

Indicators of Compromise 13

Filename 1c-office-plugin.exe Filename 1cbroker.exe Filename AdobeSync.exe Filename App_Web_Container_1.dll Filename adobe_32.exe Filename trueconf.exe GitHub Repo browserthemes/resourcepack GitHub Repo mirror-js/mirror-js MD5 1dcafb7f8448683281106b06dd22409a MD5 1f3034b706c78b35d8e34044e68c693a MD5 3ecd1cd627d0340c92901a478a7caad8 MD5 4aa9fb1bf9223dfcdac920759bc7a3c7 MD5 631fb131a56caf4ca0f287ed73e876ab

MITRE ATT&CK TTPs 10

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1055.001
Dynamic-link Library Injection
Defense Evasion
 T1078
Valid Accounts
Defense Evasion
 T1090
Proxy
Command And Control
 T1110
Brute Force
Credential Access
 T1550.002
Pass the Hash
Defense Evasion
 T1566
Phishing
Initial Access
 T1570
Lateral Tool Transfer
Lateral Movement
 T1589
Gather Victim Identity Information
Reconnaissance
 T1595.002
Vulnerability Scanning
Reconnaissance

Source Articles

NightEagle targets Russian companies
NightEagle (APT-Q-95), an advanced persistent threat group active since at least 2023, has expanded its targeting to include Russian organizations. The group initially gains access using compromised credentials and leverages Cloudflare WARP tunnels and European VPS infrastructure. They deploy a .NET-based backdoor called GhostContainer on Microsoft Exchange servers, exploiting CVE-2020-0688 and utilizing cryptographic key extraction from ASP.NET configurations. The backdoor enables command-and-control communication and traffic redirection via proxying. Attackers use legitimate tools such as Microsoft dev tunnels, rdp2tcp, and Impacket utilities for lateral movement and persistence, including exploitation of CVE-2019-0708 (BlueKeep) and DCSync attacks in Active Directory.
securelist ·1h ago