NightEagle targets Russian companies

Kaspersky’s report documents NightEagle (APT-Q-95) activity observed since 2023 expanding into Russia: attackers used compromised VPN credentials and Cloudflare WARP/European infrastructure, deployed the GhostContainer .NET backdoor on Exchange (leveraging components like Neo-reGeorg and CVE-2020-0688 exploitation), tunneled RDP using Microsoft dev tunnels and rdp2tcp, exploited CVE-2019-0708 (BlueKeep) for local elevation, and used AD attacks (DCSync, Kerberos ticket abuse) to persist and compromise domain controllers; the report includes detection methods and IOCs.