NightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN Access

Kaspersky’s Global Emergency Response Team says the NightEagle group, also known as APT-Q-95, has targeted businesses in Russia after previously focusing on organisations in Asia. In most investigated incidents, the attackers used stolen valid credentials to access corporate VPNs, connecting through Russian IP addresses linked to Cloudflare WARP tunnels and European virtual infrastructure providers. They deployed the GhostContainer .NET backdoor on Microsoft Exchange servers.

Kaspersky believes, with a high degree of confidence, that the malware was injected in memory by extracting Microsoft Exchange cryptographic keys from ASP.NET configuration, overwriting the `VIEWSTATE` parameter and inserting a payload. The researchers could not confirm the precise delivery method. GhostContainer can process commands through `x-owa-urlpostdata` headers, evade AMSI and Windows Event Log monitoring, and proxy or forward network traffic. Kaspersky detects it as `Trojan.MSIL.GhostContainer.gen`.

After gaining privileges, NightEagle used RDP for lateral movement and downloaded tools hosted in disguised GitHub repositories. The attackers combined Microsoft dev tunnels, which exposed port 3389 through `devtunnels.ms` domains, with the public `rdp2tcp` utility to tunnel traffic without opening additional suspicious ports. They also used Impacket’s `atexec` and Windows `netsh interface portproxy`.

In one incident, the group exploited CVE-2019-0708 (BlueKeep) to create a local account and add it to the Administrators and Remote Desktop Users groups. Kaspersky also observed unusual Kerberos ticket flags and attempts to perform DCSync, enabling password-hash theft, long-lived access and potential compromise of domain controllers and the wider Active Directory environment.

The company recommends monitoring for the named tunnel domains, RDP virtual-channel events with the name `rdp2tcp` or random alphanumeric names, suspicious Exchange and PowerShell activity, BlueKeep exploitation and DCSync attempts.