Russian Enterprises Targeted by Backdoor, Ransomware Attacks from Three Threat Groups

"In most incidents, the attackers used compromised valid credentials to gain access to corporate VPNs," Kaspersky said.

NightEagle and GhostContainer persistence on Microsoft Exchange

Kaspersky describes NightEagle (aka APT-Q-95) as active since at least 2023 and using a blend of credential theft, novel persistence techniques, and tunneling to compromise Russian enterprises. The actor has deployed GhostContainer, a modular backdoor that grants "complete access to a victim's Microsoft Exchange Server," can run arbitrary code, perform file operations and load additional modules, and can masquerade as a common server component to blend into normal operations.

The malware incorporates open-source components — including the Neo-reGeorg tunnel, an exploit for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility — all available on GitHub, Kaspersky reports. The exact delivery vector is unknown, though Kaspersky posits extraction of cryptographic keys from an ASP.NET configuration, overwriting the VIEWSTATE parameter and injecting a payload that launches the backdoor in memory.

NightEagle lateral movement: tunnels, RDP redirection, and Active Directory attacks

Once inside, NightEagle uses tunneling tools to redirect traffic via RDP, leveraging Microsoft dev tunnels and the open-source rdp2tcp program. The actor has exploited multiple Active Directory weaknesses to escalate privileges and move laterally. Kaspersky documents exploitation of CVE-2019-0708 (BlueKeep) to create a local account, add it to Administrators and Remote Desktop Users groups, and efforts to impersonate the domain controller with DCSync attacks.

The stated end goals are persistence in victim infrastructure, harvesting password hashes for domain accounts, using long-lived Kerberos tickets to gain legitimate access to resources, and ultimately breaking into domain controllers and the broader Active Directory infrastructure.

Hacking Cat's Gorilla RAT, Monkey ransomware family, ClearWater RaaS, and Nemo Wiper

Hacking Cat, described by Kaspersky as a pro‑Ukrainian hacktivist group active since February 2024, has shifted from website defacement and data leaks to encryption and destructive attacks. The group weaponizes Exchange server vulnerabilities (notably CVE-2021-26855 and CVE-2026-42897) to deliver a Go-based remote access trojan called Gorilla RAT that registers victims, opens TCP tunnels, and can run arbitrary commands, enumerate processes, gather system information and transfer files.

Hacking Cat also deploys a family of ransomware called Monkey in multiple language variants (Rust, .NET, C++, and Golang) targeting Windows, Linux, and VMware ESXi. Kaspersky dates the earliest Monkey artifact to late summer 2025 and catalogues variant behavior: a Rust variant uses a 32-byte key with ChaCha20-Poly1305 and in some builds does not store the key — effectively acting as a wiper while still leaving a ransom note. The .NET variant generates a 32-byte key, sends it to C2, encrypts with AES-256-CBC, escalates privileges, disables recovery mechanisms, extracts Outlook credentials, deletes backup extensions and self-deletes.

The C++ variant offers persistence via scheduled tasks or RunOnce keys, clears logs, disables logging and command histories, bypasses AMSI, disables ETW, configures Microsoft Defender exclusions, modifies the Registry to disable Task Manager and CMD, queries api.ipify[.]org and ipapi[.]co for public IP, and disables backup and recovery mechanisms including VSS. The Golang variant targets Linux and ESXi via crontab persistence, disables SELinux and AppArmor and attempts to delete shadow copies — behavior Kaspersky notes is pointless on Linux/ESXi and may indicate careless reuse or AI-assisted development.

Kaspersky also links Hacking Cat to collaborative operations: delivering ClearWater ransomware via a batch script alongside Cyber Anarchy Squad (ClearWater assessed as RaaS distributed to pro-Ukrainian crews) and deploying Nemo Wiper with the Ukrainian Cyber Alliance, which overwrites files with random bytes and fills free disk space with .lock files. Kaspersky warns that multiple hacktivist groups reuse the same self-written tools, suggesting a common developer source. Hacking Cat disputed some attributions on Telegram, saying "a couple of the tools are ours, but the lockers are definitely not."

Toy Ghouls' Bird Agent backdoor, WinRM delivery, and unconventional C2 channels

Toy Ghouls (aka Bearlyfy, Laboo.boo, and Feral Wolf), active since 2025 and previously using leaked Babuk and LockBit builders and its own GenieLocker ransomware, has moved to bespoke tooling. Kaspersky detected a custom backdoor in July 2026 appearing as two variants: mqtt-bird-agent 0.1.0 using HiveMQ MQTT broker for C2, and matrix-bird-agent 0.1.0 using the Element Matrix messenger for C2.

The group uses Windows Remote Management (WinRM) to deliver the backdoors and their configuration files, leveraging open-source tools such as Evil-WinRM and WinRM-fs. Bird Agent can run interactively or set up persistence as a Windows service. Its configuration file ("config.toml") is partially encrypted with a key derived from the machine's MachineGuid registry value, binding the config to that system; the backdoor halts if it cannot decrypt the config.

For HiveMQ, Bird Agent issues HTTP GET requests to fetch commands and executes them via PowerShell in hidden mode (-NonInteractive -NoProfile -Command); the Element variant executes received commands through the Windows CLI. Kaspersky frames the move to HiveMQ and Element — "unconventional channels" — as a deliberate shift toward custom-built tools intended to evade detection for longer.

What this means for technologists, affected enterprises, and regulators

• Technologists and security teams: expect combined use of credential-based VPN access, tunneling tools (Microsoft dev tunnels, rdp2tcp), and custom C2 channels (HiveMQ, Element). Monitor Exchange servers for GhostContainer behaviors, watch for exploitation indicators tied to CVE-2020-0688, CVE-2019-0708, CVE-2021-26855 and CVE-2026-42897, and validate WinRM usage and unexpected service creation.
• Affected enterprises and procurement leaders: note the diversity of ransomware and wiper tooling (Monkey variants, ClearWater, Nemo Wiper, GenieLocker) and that some variants intentionally destroy recovery artifacts or do not store keys — complicating incident response and insurance claims. Inventory backup and recovery protections against the described techniques (VSS disablement, registry and task changes) is essential.
• Regulators and policy-makers: Kaspersky's account highlights cross‑group code reuse and third‑party tool chains — including public open‑source components and alleged shared developers — which affects attribution and raises questions about supply, availability and misuse of dual‑use tooling.

Two threads run through Kaspersky's analysis: attackers are blending publicly available building blocks with bespoke tools to evade detection, and multiple actors are sharing or reusing components in ways that blur attribution. One concrete unknown remains central: the precise mechanism GhostContainer attackers used to deliver payloads into Exchange — Kaspersky's best reconstruction points to VIEWSTATE manipulation after cryptographic key extraction from ASP.NET configuration, but the delivery chain is not fully confirmed. That gap, and the continued shift to unconventional C2 channels, frames the next technical and operational challenges for defenders and responders.

https://thehackernews.com/2026/09/three-threat-groups-target-russian.html