NightEagle APT Targets Russian Enterprises with Advanced Malware

• •NightEagle APT (APT-Q-95) targets Russian firms using advanced malware.
• •GhostContainer backdoor allows full control over Microsoft Exchange servers.
• •Attacks coincide with ongoing geopolitical tensions in the region.

The NightEagle APT group (APT-Q-95) has escalated its cyberattacks against Russian organizations, employing sophisticated techniques for persistence and lateral movement. Utilizing stolen credentials, the group gains access to corporate VPNs, often routing through Cloudflare WARP tunnels linked to Russian IPs. The primary tool used is the GhostContainer backdoor, which allows full control over Microsoft Exchange servers. This malware integrates components from various open-source projects and is capable of running arbitrary code, manipulating files, and loading additional modules. Recent reports indicate that NightEagle's tactics have evolved, employing advanced evasion techniques to bypass common defenses. Other groups, including Hacking Cat and Toy Ghouls, are also targeting Russian enterprises, indicating a broader threat landscape amid ongoing geopolitical tensions. The attacks coincide with heightened military conflicts involving Russia and Ukraine, raising concerns about the implications for corporate security in the region.