Loading story…
NightEagle (APT-Q-95), active since at least 2023 and previously focused on Asian targets, has expanded operations against Russian businesses. The group obtained initial access primarily through compromised corporate VPN credentials, deployed the GhostContainer backdoor on Microsoft Exchange servers, and used tunneling infrastructure to preserve access and support RDP-based lateral movement.
In observed intrusions, the actors abused Active Directory weaknesses, targeted CVE-2019-0708 (BlueKeep), attempted Kerberos ticket abuse and DCSync activity, and pursued domain-controller and full Active Directory compromise. The campaign combines custom malware with public tools, legitimate Microsoft development tunnels, and native Windows port-forwarding capabilities to reduce detection opportunities.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
NightEagle, also tracked as APT-Q-95, has been active since at least 2023 and was previously focused on organizations in Asia.
Researchers reported that NightEagle used Impacket atexec to create scheduled tasks and netsh interface portproxy to forward internal traffic, in addition to dev tunnels and rdp2tcp. The report also identified GitHub repositories masquerading as legitimate resources and hashes for AdobeSync.exe and adobe_32.exe.
Researchers reported confirmed GhostContainer activity affecting a government agency and a high-tech company in Asia. They assessed that the Exchange compromise likely involved a known N-day flaw, possibly CVE-2020-0688, although the initial-access attribution remained inconclusive.
Researchers disclosed that GhostContainer receives commands through the x-owa-urlpostdata HTTP header and bypasses AMSI and Windows Event Log mechanisms by overwriting addresses in amsi.dll and ntdll.dll. They also assessed that NightEagle likely abused Exchange ASP.NET cryptographic keys and the VIEWSTATE parameter to launch the payload in memory.
In one observed incident, NightEagle exploited CVE-2019-0708 (BlueKeep) to create and elevate a local account. The group also abused Kerberos ticket requests and attempted DCSync activity in pursuit of domain-controller and Active Directory compromise.
The group used Microsoft dev tunnels to expose RDP and rdp2tcp to tunnel traffic through established RDP sessions, enabling access and lateral movement while avoiding additional suspicious open ports.
During observed intrusions, NightEagle deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, using it for command handling, proxying, virtual-path redirection, and socket forwarding.
NightEagle expanded its operations to target businesses in Russia, commonly using compromised valid credentials to access corporate VPNs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked threat actor tracked as **FamousSparrow** and `UAT-9244` repeatedly compromised an unnamed Azerbaijani oil and gas company in a multi-wave campaign that ran from late December 2025 through late February 2026. Bitdefender assessed with moderate-to-high confidence that the attackers gained initial access by exploiting a vulnerable **Microsoft Exchange Server**, likely through the `ProxyNotShell` chain, and repeatedly re-entered the environment even after remediation efforts. The targeting expands the group's known victimology into Azerbaijan, a country with growing strategic importance to European energy security. Across three intrusion waves, the operators deployed or attempted to deploy **Deed RAT** (also known as **Snappybee**), **TernDoor**, and a modified version of Deed RAT, while using web shells, lateral movement, and redundant footholds to preserve access. Researchers also reported an evolved DLL side-loading technique that abused the legitimate **LogMeIn Hamachi** binary to help evade defenses. The operation was described as sustained and adaptive, with the attackers changing payloads and persistence methods while continuing to exploit the same Exchange entry point.
Jun 29, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Trend Micro and TrendAI reported that **Earth Estries**, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted **government, telecommunications, and technology-sector organizations**, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in **FamousSparrow** and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership. Researchers said Earth Estries gained initial access by exploiting public-facing systems, including **Ivanti Connect Secure**, **Fortinet FortiClient EMS** SQL injection flaws, **Sophos Firewall** code injection bugs, and the **Microsoft Exchange ProxyLogon** chain. After breaching servers and administrative accounts, the actors used **PowerShell downgrade attacks**, **DLL sideloading**, **living-off-the-land binaries**, **Cobalt Strike**, **SMB**, and **WMIC** for persistence and lateral movement, while deploying backdoors and implants such as **Zingdoor**, **HemiGate**, **TrillClient**, **GHOSTSPIDER**, **SNAPPYBEE**, **DEMODEX**, and **MASOL RAT**. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including **Fastly CDN** fronting and infrastructure patterns consistent with DNS tunneling.
Aug 21, 2026