Three Threat Groups Target Russian Enterprises With Backdoors Ransomware And Wipers

www.itsecuritynews.info • September 17, 2026

The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NightEagle APT Targets Russian Enterprises with Advanced Malware The NightEagle APT group (APT-Q-95) has escalated its cyberattacks against Russian organizations, employing sophisticated techniques for persistence and lateral movement. Utilizing stolen credentials, the group gains access to corporate VPNs, often routing through Cloudflare WARP tunnels linked to Russian IPs. The primary tool used is the GhostContainer backdoor, which allows full control over Microsoft Exchange servers. This malware integrates components from various open-source projects and is capable of running arbitrary code, manipulating files, and loading additional modules. Recent reports indicate that NightEagle's tactics have evolved, employing advanced evasion techniques to bypass common defenses. Other groups, including Hacking Cat and Toy Ghouls, are also targeting Russian enterprises, indicating a broader threat landscape amid ongoing geopolitical tensions. The attacks coincide with heightened military conflicts involving Russia and Ukraine, raising concerns about the implications for corporate security in the region. 5 sources 78

Three Threat Groups Target Russian Enterprises With Backdoors Ransomware And Wipers

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)