NightEagle APT Targets Russian Enterprises with GhostContainer Backdoor

• •NightEagle APT targets Russian organizations using GhostContainer backdoor.
• •Attacks exploit compromised VPN credentials and involve lateral movement techniques.
• •GhostContainer utilizes components from open-source projects to evade detection.

The NightEagle group (APT-Q-95) has expanded its operations to target Russian enterprises, utilizing compromised valid credentials to access corporate VPNs. Recent attacks involved deploying the GhostContainer backdoor on Microsoft Exchange servers, which allows for full control over the system. The attackers employed techniques such as extracting cryptographic keys from ASP.NET configurations and injecting malicious payloads. The backdoor, which incorporates components from open-source projects, enables lateral movement within networks using tools for tunneling and traffic redirection. Kaspersky has confirmed that these attacks also exploit vulnerabilities in Active Directory, aiming to establish persistence and access sensitive data. The group has been active since at least 2023, previously focusing on Asian organizations. Current investigations are ongoing to assess the full scope of the impact.