Cyber Espionage Group NightEagle Expands Operations to Russian Companies, Previously Targeted China's High-Tech Sector
NightEagle, also known as APT-Q-95, a cyber espionage group previously focused on targeting sensitive technology and defense organizations in China, has expanded its operations to include Russian companies. Active since at least 2023, the group initially concentrated its attacks within Asia. Over the past year, Russian cybersecurity firm Kaspersky has investigated multiple incidents involving NightEagle at Russian businesses. The group typically gains initial access to corporate networks using stolen credentials via virtual private networks (VPNs). Once inside, NightEagle targets Microsoft Exchange email servers and installs a backdoor called GhostContainer, which allows remote control of compromised servers, evasion of some Windows security and logging mechanisms, and redirection of network traffic. Researchers believe the attackers extract encryption keys from Exchange and manipulate Microsoft's web application framework to execute the backdoor directly in memory. NightEagle also uses GitHub to store arc...
