🔴 NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor

The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks.

Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously concentrated on organizations across Asia.

The newly investigated intrusions show a shift in the group’s geographic targeting and an increasingly mature tradecraft designed to preserve covert access to enterprise environments.