Back Ground.News

Three Adversary Groups Deploy Backdoors, Ransomware and Wiper Malware

Ground.News • September 17, 2026

Russian Firms Under Fire: Three Adversary Groups Deploy Backdoors, Ransomware and Wiper Malware

Three threat groups are hitting Russian companies with advanced backdoors, ransomware and custom wipers. Kaspersky details the tactics of NightEagle, Hacking Cat and Toy Ghouls. The campaigns reveal evolving capabilities and strategic intent amid the Ukraine conflict. New U.S. and UK warnings highlight parallel Russian-linked operations.

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky. The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.

100 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NightEagle APT Targets Russian Enterprises with Advanced Malware The NightEagle APT group (APT-Q-95) has escalated its cyberattacks against Russian organizations, employing sophisticated techniques for persistence and lateral movement. Utilizing stolen credentials, the group gains access to corporate VPNs, often routing through Cloudflare WARP tunnels linked to Russian IPs. The primary tool used is the GhostContainer backdoor, which allows full control over Microsoft Exchange servers. This malware integrates components from various open-source projects and is capable of running arbitrary code, manipulating files, and loading additional modules. Recent reports indicate that NightEagle's tactics have evolved, employing advanced evasion techniques to bypass common defenses. Other groups, including Hacking Cat and Toy Ghouls, are also targeting Russian enterprises, indicating a broader threat landscape amid ongoing geopolitical tensions. The attacks coincide with heightened military conflicts involving Russia and Ukraine, raising concerns about the implications for corporate security in the region. 11 sources 78

Extracted Entities

Three Adversary Groups Deploy Backdoors, Ransomware and Wiper Malware

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Countries (2)