Reported by 7 outlets
NightEagle targets Russian companies
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
NightEagle, the APT group Kaspersky tracks as APT-Q-95, has moved from Asian targets to Russian businesses, and the 16 September 2026 GERT report lays out the mechanics. In most incidents the group entered through corporate VPNs using valid stolen credentials, with sessions originating from Russian addresses linked to Cloudflare WARP tunnels and European virtual infrastructure providers. The signature move is the GhostContainer backdoor on Microsoft Exchange, a .NET assembly whose Stub class reads C2 commands from x-owa-urlpostdata headers and patches amsi.dll and ntdll.dll to blind AMSI and the Windows event log, running entirely in memory. Delivery was not confirmed, but Kaspersky assesses with high confidence that the attackers extracted Exchange machine keys from the ASP.NET configuration and overwrote the VIEWSTATE parameter to launch the payload, a chain assembled from public parts: an exploit for CVE-2020-0688, the GhostWebShell class from ysoserial, and the Neo-reGeorg tunnel. No new Exchange vulnerability appears in this campaign; Kaspersky detects the implant as Trojan.MSIL.GhostContainer.gen.
The dates are the argument. CVE-2020-0688 was published 2020-02-11 with NVD scoring it CVSS 3.1 8.8, so the bug at the center of a 2026 espionage campaign is six years past its fix, and patch state alone decides less than it seems: GhostContainer's Stub carries code copied from machinekeyfinder-aspx that reads the validation key at runtime, meaning the VIEWSTATE technique runs on key material an attacker can harvest in memory rather than on a missing update that a scanner would flag. The group QiAnXin disclosed on 2025-07-04 stole nearly a year of email from Chinese semiconductor, quantum, AI and military organizations; the same operator class is now doing this to Russian companies with a toolchain of stolen VPN logins, a 2020 n-day and GitHub utilities, which means exposure is defined by internet-reachable Exchange and VPN estates everywhere, not by the two geographies named. The follow-on toolset tells you the objective: Impacket atexec, netsh portproxy rules, rdp2tcp over RDP virtual channels, Microsoft dev tunnels exposing port 3389, BlueKeep CVE-2019-0708 exploitation in one incident to mint an account in the Administrators and Remote Desktop Users groups, Kerberos tickets with the Forwardable, Proxiable, Renewable flag combination, then DCSync, ending at the domain controllers and every hash in the directory.
Remediation has no new patch, so precision matters. Confirm every Exchange server carries the February 2020 CVE-2020-0688 fix, and treat any host missing a 2020 update as presumptively exposed to CVE-2019-0708 (fixed May 2019) as well. Rotate and force MFA on VPN credentials, since initial access rides valid logins, and prioritize accounts that authenticated from WARP-linked or European VPS addresses. The hunt has specific anchors: in Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx, events 132 and 148 whose channel name is rdp2tcp or random alphanumerics instead of XPSRD, cliprdr or Microsoft::Windows::RDS::DisplayControl; DNS or TLS to *.devtunnels.ms; netsh interface portproxy add v4tov4 commands in scheduled-task history (the report's sample forwards listenport=443 to port 445); IIS and Exchange logs carrying x-owa-urlpostdata requests or the /wEPDwUKLTcyODc4 VIEWSTATE marker; downloads from github.com/mirror-js/mirror-js and github.com/browserthemes/resourcepack; and the report's MD5s: 1dcafb7f8448683281106b06dd22409a (AdobeSync.exe), 1f3034b706c78b35d8e34044e68c693a (adobe_32.exe), 3ecd1cd627d0340c92901a478a7caad8 and 631fb131a56caf4ca0f287ed73e876ab (App_Web_Container_1.dll), 4aa9fb1bf9223dfcdac920759bc7a3c7 (1c-office-plugin.exe, 1cbroker.exe, trueconf.exe). Add DCSync detection on replication of the Domain-Password object and flag TGS requests pairing Forwardable with Proxiable and Renewable.
Two developments would change this assessment. First, confirmation of the Exchange delivery method: if a zero-day surfaces, patching regains primacy; if key theft alone explains it, the durable fix is credential and machineKey rotation plus inbound RDP-to-Exchange request filtering, and Kaspersky stating the method is undetermined leaves both doors open. Second, scope reporting: victim counts or dwell times for the Russian cases (QiAnXin measured roughly a year of email access in 2025), or evidence the Asia-to-Russia shift extends further, would widen the exposure picture, and a public GhostContainer port or weaponized CVE-2020-0688-plus-key-theft package would drop the entry bar for imitators who lack NightEagle's discipline.
Timeline
-
original reporting
NightEagle targets Russian companies
malware.news · 27d ago · September 16th, 2026
Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95). This group has been active since at least 2023 and originally focused on organizations in Asia, as we reported previously . We have now identified attacks by the group targeting businesses in Russia. This post examines both known and new tools NightEagle used in its latest campaign. Initial access In most incidents, the attackers used compromised valid credentials to gain access to corporate VPNs. VPN connections originated from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from IP addresses associated with European virtual infrastructure providers. GhostContainer on Microsoft Exchange Both during the initial access stage and as the attack progressed, the attackers deployed the GhostContainer backdoor on Microsoft Exchange servers. It incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility. All of these components are publicly available on GitHub. We were unable to determine the exact method
-
update from nvd.nist.gov
NVD record for CVE-2020-0688 (Microsoft Exchange remote code execution)
nvd.nist.gov · 2436d ago · February 11th, 2020
The NVD record for CVE-2020-0688, the Microsoft Exchange VIEWSTATE deserialization flaw whose exploit ships inside GhostContainer, was published 2020-02-11, six and a half years before the Russia campaign reporting. NVD scores it CVSS 3.1 base 8.8 HIGH with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring only low privileges over the network. The February 2020 fix is the patch floor every Exchange server in the NightEagle story must be measured against.
-
update from github.com
RedDrip7/NightEagle_Disclose: QiAnXin exclusive disclosure of the NightEagle APT group
github.com · 467d ago · July 4th, 2025
Repository created 2025-07-04 by QiAnXin's RedDrip7 team, described as sharing threat intelligence and detection tools for APT NightEagle (APT-Q-95). It carries the report 'Exclusive disclosure of the attack activities of the APT group NightEagle.pdf' in English and Chinese plus apt-q-95_checktool detection executables and checksums. This is the original researcher disclosure that first publicly named NightEagle as APT-Q-95.
-
update from cybersecuritynews.com
NightEagle APT Attacking Industrial Systems by Exploiting 0-Days and With Adaptive Malware
cybersecuritynews.com · 464d ago · July 7th, 2025
Early coverage of the QiAnXin disclosure, published July 7, 2025, three days after the RedDrip7 repository appeared. It reports NightEagle (APT-Q-95) attacking China's high-tech, semiconductor, quantum, AI and military sectors since 2023, using unknown Exchange vulnerabilities to steal machineKey material and deploy memory-resident implants, with Go-based Chisel tunneling over port 443, per-target attack domains such as synologyupdates.com and comfyupdate.org, a 9 PM to 6 AM Beijing-time activity window, and nearly a year of email theft from victims.
-
update from securelist.com
GhostContainer backdoor: malware compromising Exchange servers of high-value organizations in Asia
securelist.com · 454d ago · July 17th, 2025
Kaspersky GReAT's first public GhostContainer analysis, posted 17 Jul 2025, fourteen months before the Russia campaign report. It dissects the App_Web_Container_1.dll .NET backdoor (Stub, App_Web_843e75cf5b63, App_Web_8c9b251fb5b3 classes), links its code to ExchangeCmdPy.py and CVE-2020-0688 via the hardcoded /wEPDwUKLTcyODc4 VIEWSTATE marker, notes the validation key is read using code from machinekeyfinder-aspx, and identifies two Asian victims: a key government agency and a high-tech company. The backdoor exposes no C2 infrastructure because the attacker connects inbound to the compromised server.
-
update from gbhackers.com
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
gbhackers.com · 26d ago · September 17th, 2026
The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks. Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously […] The post NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
NightEagle Expands Into Russia With GhostContainer Backdoor and RDP Tunneling Tools
cyberpress.org · 26d ago · September 17th, 2026
This approach helps the attackers blend into normal network activity while moving through victim environments. Researchers could not confirm the exact infection method. However, they believe the attackers likely extracted Exchange cryptographic keys from ASP.NET configur
-
update from cyberpress.org
NightEagle Deploys GhostContainer Backdoor on Microsoft Exchange Servers in Russian Attacks
cyberpress.org · 22d ago · September 21st, 2026
The group, active since at least 2023, originally focused on targets in Asia but has now expanded its geographic scope to Russian businesses, signaling a broadening threat surface for enterprise mail infrastructure. Kaspersky could not conclusively determine the exact delivery mechanism for GhostContainer but assesses with high confidence that attackers extracted cryptographic keys from Exchange’s ASP.NET configuration, then overwrote the VIEWSTATE parameter to inject a payload that launched the backdoor directly in memory a technique that leaves minimal disk artifacts. Its functionality is split across three classes: Stub processes command-and-control instructi