NightEagle, also tracked as APT-Q-95, has begun targeting businesses in Russia after previously focusing on organizations in Asia. The campaign matters mainly to companies running Microsoft Exchange, VPN access and Windows domain networks rather than typical home users.
Organizations should review successful VPN logins for unusual locations, devices and times, reset credentials linked to suspicious sessions, and require multi-factor authentication. Exchange servers and VPN accounts exposed to the internet deserve priority.
Kaspersky could not determine exactly how GhostContainer reached the Exchange servers. Its researchers assess with high confidence that NightEagle extracted Exchange cryptographic keys, altered the VIEWSTATE web parameter and used it to launch the backdoor in memory.
In one incident, the attackers also exploited BlueKeep, tracked as CVE-2019-0708, to create a local account and place it in the Administrators and Remote Desktop Users groups. Further Active Directory activity could expose domain password hashes and ultimately compromise domain controllers.
Stolen VPN credentials provide the first foothold
Kaspersky researchers found that most investigated intrusions began with compromised, valid VPN credentials. Connections came through Cloudflare WARP addresses in Russia and infrastructure operated by European virtual-server providers.Organizations should review successful VPN logins for unusual locations, devices and times, reset credentials linked to suspicious sessions, and require multi-factor authentication. Exchange servers and VPN accounts exposed to the internet deserve priority.
- Check Exchange systems for App_Web_Container_1.dll and detections named Trojan.MSIL.GhostContainer.gen.
- Investigate unexpected adobe_32.exe or AdobeSync.exe files; the names imitate legitimate software.
- Review Remote Desktop event IDs 132 and 148 for a channel named rdp2tcp or unexplained random channel names.
GhostContainer hides on Exchange
The attackers installed the GhostContainer backdoor on Microsoft Exchange servers. A backdoor is malware that gives an intruder continuing remote access; this one can receive commands, redirect network traffic and interfere with some Windows scanning and logging mechanisms.Kaspersky could not determine exactly how GhostContainer reached the Exchange servers. Its researchers assess with high confidence that NightEagle extracted Exchange cryptographic keys, altered the VIEWSTATE web parameter and used it to launch the backdoor in memory.
Legitimate tools help attackers blend in
After gaining enough privileges, NightEagle used Remote Desktop and combined Microsoft dev tunnels with the public rdp2tcp tool. This let the group preserve network access through legitimate services without opening additional suspicious ports.In one incident, the attackers also exploited BlueKeep, tracked as CVE-2019-0708, to create a local account and place it in the Administrators and Remote Desktop Users groups. Further Active Directory activity could expose domain password hashes and ultimately compromise domain controllers.
