Threat actor

NightEagle

United States · espionage

Tracked by CyberSIXT since 16 Sep

Articlesall time: 3
Articleslast 30 days: 0
CVEs exploitedattributed · all time: 2
Research reportsall time: 0

Three articles so far, 16 Sep to 21 Sep.

1 2 3

Wed 16 Sep · first reportNightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN AccessSecurelist
Wed 16 SepThree Threat Groups Target Russian Enterprises With Destructive MalwareThe Hacker News
Mon 21 SepNightEagle Hackers Target Russian Firms With GhostContainer BackdoorSecurityOnline

See the full timeline

Diamond Model

What the record links to NightEagle

Recorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).

Adversary2namesAPT-Q-95CyberSIXT coverage, Malpedia, MISP Galaxy Capability2exploited CVEsCVE-2019-0708, CVE-2020-0688CyberSIXT coverage

InfrastructureNot recorded for this actor

Victim65 sectors · 1 suspected victimGovernment, Administration, Military, Private Sector · in 1 countryMISP Galaxy

Names and sources

NightEagle: CyberSIXT coverage, Malpedia, MISP Galaxy
APT-Q-95: Malpedia, MISP Galaxy

Attributed facts

Origin: United States MISP Galaxy
Sponsor: United States MISP Galaxy
Motivation: Espionage MISP Galaxy
Sectors: Government, Administration, Military, Private Sector, Technology MISP Galaxy
Suspected victims: China MISP Galaxy

CVEs exploited

2 CVEs an article attributes to NightEagle

CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution Vulnerability · attributed by Kaspersky, Kaspersky’s Global Emergency Response Team, 16 Sep · Source articleCVSS9.8CriticalExploited99.9%EPSS0articles

CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability · attributed by Kaspersky’s Global Emergency Response Team, 21 Sep · Source articleCVSS8.8HighExploited99.9%EPSS0articles