NightEagle and Toy Ghouls Join Hacking Cat in Hitting Russian Firms

Kaspersky researchers describe three distinct threat clusters—NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls—targeting Russian enterprises with a mix of state-aligned espionage, hacktivism, and financially motivated operations; notable findings include NightEagle’s GhostContainer backdoor nesting in Exchange, reuse of BlueKeep and AD flaws, Toy Ghouls’ MQTT/Matrix-based C2 and GenieLocker ransomware, and overlapping initial-access techniques such as compromised VPN credentials and Exchange exploitation.