NightEagle APT Targets Russia With GhostContainer Backdoor

Threat group: NightEagle APT (APT-Q-95) has been active since at least 2023 and, after focusing on Asia, now targets Russian businesses.

Core backdoor: The attackers deployed GhostContainer on Microsoft Exchange servers, which includes a CVE-2020-0688 exploit.

Lateral movement: Attackers combined CVE-2019-0708 (BlueKeep), DCSync, and Kerberos ticket abuse to seize Active Directory.

NightEagle, tracked as APT-Q-95 and previously known for targeting Asian organizations since 2023, has now been confirmed to be attacking businesses in Russia, deploying its signature GhostContainer backdoor alongside a refreshed toolkit for tunneling and lateral movement.

NightEagle Shifts to Russian Organizations. Entry Point: Stolen VPN Credentials

Kaspersky's Global Emergency Response Team (GERT) has spent the past year investigating a wave of incidents linked to NightEagle. In most documented cases, the APT gained entry using compromised, valid corporate VPN credentials.

The connections traced back to IP addresses within Russia's Cloudflare WARP tunnel segment, as well as European virtual infrastructure providers.

Inside GhostContainer: How the Exchange Backdoor Works

Once inside, the attackers planted GhostContainer on Microsoft Exchange servers. Built from open-source components – the Neo-reGeorg tunnel, a CVE-2020-0688 exploit, and the GhostWebShell class from ysoserial – the malware is assessed with high confidence to work by:

extracting ASP.NET cryptographic keys,

overwriting the VIEWSTATE parameter,

injecting a payload that launches the .NET backdoor directly in memory

evading AMSI and Windows Event Log detection.

Disguised Tools and Traffic Redirection

For persistence, NightEagle paired Microsoft 's legitimate dev tunnels service ( *.devtunnels.ms ) with the open-source rdp2tcp tool to expose Remote Desktop Protocol (RDP) (port 3389) without raising obvious red flags.

Malicious executables were renamed to mimic trusted software – including adobe_32.exe, AdobeSync.exe, trueconf.exe , and 1cbroker.exe – and hosted in GitHub repositories designed to look benign.

Active Directory Under Siege

To escalate privileges and ultimately compromise entire Active Directory (AD) environments, the group:

exploited the Remote Code Execution ( RCE ) BlueKeep RDP flaw (CVE-2019-0708),

requested Kerberos tickets with non-standard flag combinations,

performed DCSync attacks to impersonate domain controllers.

Kaspersky's Confidence Level and Mitigation

Kaspersky attributes the campaign to NightEagle with high confidence, based on GhostContainer code similarities and detection rules.

Microsoft offered security updates in the Update Catalog only for platforms that are no longer in mainstream support to cover CVE-2019-0708 . Customers running one of these operating systems should download and install the update as soon as possible.

In May, the Cloud Atlas APT targeted Russia and Belarus government and diplomatic entities with the PowerCloud tool.