NightEagle Exploits Legitimate Tools to Target Russian Firms

"Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95)." — Kaspersky's Global Emergency Response Team (GERT).

Initial access: compromised VPN credentials and Cloudflare WARP

Kaspersky’s GERT found that NightEagle most commonly gained initial access by using compromised, valid credentials to log into corporate VPNs. VPN connections in the incidents reviewed originated from IP addresses in the Russian segment tied to Cloudflare WARP tunnels and from IP ranges belonging to European virtual infrastructure providers. In several cases the investigators could trace later stages back to those VPN sessions.

GhostContainer backdoor deployed on Microsoft Exchange

On both entry and escalation paths the attackers deployed a .NET backdoor Kaspersky calls GhostContainer on Microsoft Exchange servers. GhostContainer incorporates public open‑source components — including the Neo‑reGeorg tunnel, an exploit for CVE‑2020‑0688, and the GhostWebShell class from the ysoserial utility — all available on GitHub. Kaspersky was unable to observe the exact delivery mechanism but says with a high degree of confidence the attackers extracted Exchange cryptographic keys from ASP.NET configuration, overwrote the VIEWSTATE framework parameter, and injected a payload that launched the GhostContainer backdoor in memory.

The GhostContainer assembly contains three classes with distinct roles: Stub (which processes C2 commands via the x-owa-urlpostdata header and modifies amsi.dll and ntdll.dll to evade AMSI and Windows Event Log), App_Web_843e75cf5b63 (which accepts fakePath and fakePageName parameters and creates virtual paths that redirect requests), and App_Web_8c9b251fb5b3 (which implements proxying and socket forwarding). Kaspersky products detect this backdoor as Trojan.MSIL.GhostContainer.gen.

Tunneling and traffic redirection: devtunnels.ms, rdp2tcp, and Impacket

Once they obtained sufficient privileges, the attackers used legitimate tunneling mechanisms and public tools to forward and expose internal services. Kaspersky documented two primary tunneling techniques used together:

• Microsoft dev tunnels: the attackers used the dev tunnels mechanism to publish local web services to *.devtunnels.ms domains and thereby expose port 3389 (RDP) on compromised hosts to the internet.
• rdp2tcp: a publicly available tool that tunnels TCP traffic over an established RDP connection. The rdp2tcp server component runs on the target and the client runs on the attacker side; its use produces Remote Desktop Services operational log events (IDs 132 and 148) that can contain the channel name rdp2tcp or other random strings.

Kaspersky found the actors hosting archived tools on GitHub repositories disguised to look legitimate, for example:

• https://github[.]com/mirror-js/mirror-js (files: js-webpack.zip, jsonp-pack.zip)
• https://github[.]com/browserthemes/resourcepack (resource-pack.zip)

Files extracted from those archives bore innocent names such as adobe_32.exe, AdobeSync.exe, trueconf.exe, 1cbroker.exe, 1c-office-plugin.exe, and trueconf-broker.exe. The attackers also used Impacket’s atexec utility to create scheduled tasks that set up Windows port forwarding using native tools; Kaspersky cites an example netsh command used by the actors:

• netsh interface portproxy add v4tov4 listenport=443 connectaddress=10.0.12.101 connectport=445

Lateral movement: CVE‑2019‑0708 (BlueKeep), Kerberos flags, and DCSync attempts

For privilege escalation and lateral movement NightEagle exploited multiple Active Directory weaknesses. In one incident the attackers exploited CVE‑2019‑0708 (BlueKeep) against an RDP implementation to create a local account and add it to the Administrators and Remote Desktop Users groups. Kaspersky captured memory artifacts that show the BlueKeep exploit in use.

Investigators also observed requests for Kerberos tickets with a non‑standard combination of flags — Forwardable, Proxiable, Renewable — and attempts to replicate the Domain‑Password object from the Active Directory database to impersonate the domain controller (a DCSync technique). Through these methods the attackers aimed to persist, extract domain account password hashes, and use long‑lived Kerberos tickets to access target resources and compromise domain controllers.

Detection, signatures, and indicators of compromise

Kaspersky reports that its endpoint and network products detect multiple stages of this activity. Kaspersky Threat Attribution Engine (KTAE) linked the discovered backdoor to previously analyzed GhostContainer samples and NightEagle. Kaspersky Endpoint Detection and Response Expert flags include rules named generic_ransomware_related_detection, suspicious_assembly_loading_into_powershell_via_reflection, detection_of_access_to_tunnel_domains_dns, impacket_possible_activity, and potential_dcsync_via_startupparameters. Kaspersky Anti Targeted Attack (KATA) includes signatures such as Exploit.CVE-2019-0708.TCP.C&C for BlueKeep exploitation.

Kaspersky published several file hashes and references as indicators of compromise:

• 1dcafb7f8448683281106b06dd22409a — AdobeSync.exe
• 1f3034b706c78b35d8e34044e68c693a — adobe_32.exe
• 3ecd1cd627d0340c92901a478a7caad8 — 631fb131a56caf4ca0f287ed73e876ab App_Web_Container_1.dll
• 4aa9fb1bf9223dfcdac920759bc7a3c7 — 1c-office-plugin.exe, 1cbroker.exe, trueconf.exe
• https://github[.]com/mirror-js/mirror-js
• https://github[.]com/browserthemes/resourcepack

What this means for technologists, enterprises, and incident responders

• Technologists and security teams: monitor for abnormal VPN connections from Cloudflare WARP‑linked IPs and scan for RDP exposure via *.devtunnels.ms domains and Remote Desktop Services events (IDs 132 and 148) that reference unusual channel names such as rdp2tcp.
• Enterprises and defenders: prioritize detection rules named by Kaspersky (generic_ransomware_related_detection; suspicious_assembly_loading_into_powershell_via_reflection; detection_of_access_to_tunnel_domains_dns; impacket_possible_activity; potential_dcsync_via_startupparameters) and validate protections against CVE‑2019‑0708 and CVE‑2020‑0688 exploitation paths highlighted in the investigation.
• Incident responders: be aware that GhostContainer uses VIEWSTATE injection and in‑memory .NET components that tamper with AMSI and ntdll.dll; combine file similarity analysis with EDR telemetry for memory and log artifacts.

NightEagle’s campaign shows a pragmatic blending of public tools, legitimate tunneling services, and targeted exploits to expand operations into Russia. Kaspersky’s analysis underscores that the group favors valid credentials and native or widely used services to hide access, and that careful monitoring of the artifacts and indicators above can expose their activity before it reaches domain controllers. Read the full technical post here: https://securelist.com/tr/nighteagle-apt-ghostcontainer-and-tunneling/121323/