NightEagle targets Russian companies

Immediate Actions

Key Takeaways

• NightEagle (APT-Q-95) expanded targeting from Asia to Russian businesses.
• GhostContainer backdoor uses Neo-reGeorg tunnel, CVE-2020-0688 exploit, and GhostWebShell from ysoserial.
• Attackers abuse Microsoft dev tunnels (*.devtunnels.ms) to expose RDP port 3389 externally.
• rdp2tcp tool creates RDP virtual channels named 'rdp2tcp' or random alphanumeric strings, logged in Event IDs 132 and 148.
• Attackers exploit CVE-2019-0708 (BlueKeep) to create local admin accounts for lateral movement.

Attack Chain

1. Initial Access: Attackers use compromised VPN credentials to access corporate networks
2. Persistence: GhostContainer backdoor deployed on Microsoft Exchange via VIEWSTATE injection
3. Defense Evasion: Backdoor evades AMSI and Windows Event Log by patching amsi.dll and ntdll.dll
4. Lateral Movement: RDP used with Microsoft dev tunnels and rdp2tcp for covert network tunneling
5. Privilege Escalation: CVE-2019-0708 (BlueKeep) exploited to create local admin accounts
6. Credential Access: DCSync and Kerberos ticket requests with non-standard flags for domain compromise

Affected Systems

• Microsoft Exchange servers
• Windows systems with RDP enabled
• Active Directory infrastructure
• Corporate VPN gateways

Vulnerabilities (CVEs)

Detection Availability

• Published: Other detection logic
• Platforms: Kaspersky EDR Expert, Kaspersky Anti Targeted Attack (KATA), Kaspersky Threat Analysis

Kaspersky detection rules available for GhostContainer, tunneling, Impacket, and BlueKeep activity.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
• PowerShell Script Block Logging
• AMSI event logs
• DNS resolution logs
• VPN authentication logs
• Windows Event Logs (Security)

Key Behavioral Indicators

• RDP channel named 'rdp2tcp' in Event ID 132/148
• PowerShell loading .NET assembly via reflection in Exchange context
• DNS queries to *.devtunnels.ms from internal servers
• netsh portproxy commands creating v4tov4 forwarding rules
• AMSI and ntdll.dll memory patching from .NET assemblies
• Scheduled tasks created via Impacket atexec.py

Control Gaps

• VPN credential-based access lacks MFA enforcement
• Signature-based AV may miss .NET reflection loading
• Legitimate dev tunnel traffic may not be blocked by default
• AMSI patching may not alert without memory scanning

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Patch Microsoft Exchange for CVE-2020-0688 and secure VIEWSTATE configuration
• Disable unnecessary RDP services and restrict access via network segmentation
• Monitor and alert on DCSync replication requests and anomalous Kerberos ticket flags
• Block known GitHub repositories hosting attacker tools

User Protection

• Deploy EDR with behavioral detection for AMSI patching and .NET reflection loading
• Monitor for masqueraded executables with legitimate software names in unusual paths
• Enable PowerShell Script Block Logging and AMSI logging on all endpoints

Security Awareness

• Train employees on credential hygiene and phishing-resistant MFA adoption
• Review VPN access logs for connections from Cloudflare WARP and European VPS IPs

MITRE ATT&CK Mapping

Plain-Language Summary

A hacker group called NightEagle has been breaking into Russian company networks using stolen VPN login details. They install a hidden backdoor program on Microsoft Exchange email servers to maintain access. The attackers use legitimate Microsoft tunneling tools and other software to secretly connect to internal systems and move through the network. They exploit known software vulnerabilities to gain administrator privileges and steal password information from the organization's central directory.

Additional IOCs

• Urls:
  • hxxps://github[.]com/mirror-js/mirror-js - GitHub repository hosting attacker tools
  • hxxps://github[.]com/browserthemes/resourcepack - GitHub repository hosting attacker tools
• File Hashes:
  • 01d98380dfb9211251c75c87ddb3c79c (MD5) - Similar GhostContainer sample identified by KTAE
  • 0e55330ab871209ccd7b2249147a20a8 (MD5) - Similar GhostContainer sample identified by KTAE
  • 69560ddf46e7267df623ead5769fa25c (MD5) - Similar GhostContainer sample identified by KTAE
  • c9f5837fd275648991b74c17f62cf186 (MD5) - Similar GhostContainer sample identified by KTAE
• File Paths:
  • App_Web_Container_1.dll - GhostContainer backdoor DLL filename
  • adobe_32.exe - Masqueraded tunneling tool filename
  • AdobeSync.exe - Masqueraded tunneling tool filename
  • trueconf.exe - Masqueraded tunneling tool filename
  • 1cbroker.exe - Masqueraded tunneling tool filename
  • 1c-office-plugin.exe - Masqueraded tunneling tool filename
  • trueconf-broker.exe - Masqueraded tunneling tool filename
• Command Lines:
  • Purpose: Network port forwarding via netsh portproxy | Tools: netsh.exe | Stage: Lateral Movement | netsh interface portproxy add v4tov4 listenport= connectaddress= connectport=
  • Purpose: Create local account and add to admin/RDP groups via BlueKeep shellcode | Tools: net.exe | Stage: Privilege Escalation
  • Purpose: Scheduled task creation for lateral movement via Impacket atexec | Tools: atexec.py, python.exe | Stage: Execution | atexec.py
• Other:
  • rdp2tcp - RDP virtual channel name used by rdp2tcp tunneling tool