Threats & Adversaries · APT / Espionage
NightEagle reuses credentials and GitHub tooling Kaspersky GERT says NightEagle (APT-Q-95) has shifted its campaign to Russian businesses, using compromised VPN credentials, Cloudflare WARP tunnels, and tools hosted on GitHub. The group has been active since at least 2023 and previously focused on organizations in Asia.
The access path is plain but hard to spot: valid credentials open the VPN, then the operators use Microsoft Exchange as a foothold and move through Active Directory and RDP with downloaded tunneling tools. Kaspersky says GhostContainer can run in memory, proxy traffic, and evade common logging and scanning hooks, which means the intrusion can look like legitimate remote access instead of dropped malware.
The larger lesson is reuse. Because parts of the tradecraft are built from public components, the same Exchange/AD/RDP playbook is easier for other operators to copy or adapt, so environments that treat cloud-tunneled logins and remote admin channels as trusted inherit the same exposure even if NightEagle itself is not present.
3 sources · Sep 18
Timeline Sources Sep 18 The Record from Recorded Future
Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Over the past year, Russian cybersecurity firm Kaspersky said it investigated several incidents involving the group at Russian businesses.
original Sep 16 The Hacker News
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky reports three threat clusters targeting Russian enterprises with backdoors, ransomware, wipers, and compromised VPN credentials.
original Sep 16 Kaspersky Securelist
NightEagle APT targets Russian organizations
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-16
Every edition of this story: NightEagle reuses credentials and GitHub tooling
More from today Threats & Adversaries · APT / Espionage
NightEagle reuses credentials and GitHub tooling Kaspersky GERT says NightEagle (APT-Q-95) has shifted its campaign to Russian businesses, using compromised VPN credentials, Cloudflare WARP tunnels, and tools hosted on GitHub. The group has been active since at least 2023 and previously focused on organizations in Asia.
The access path is plain but hard to spot: valid credentials open the VPN, then the operators use Microsoft Exchange as a foothold and move through Active Directory and RDP with downloaded tunneling tools. Kaspersky says GhostContainer can run in memory, proxy traffic, and evade common logging and scanning hooks, which means the intrusion can look like legitimate remote access instead of dropped malware.
The larger lesson is reuse. Because parts of the tradecraft are built from public components, the same Exchange/AD/RDP playbook is easier for other operators to copy or adapt, so environments that treat cloud-tunneled logins and remote admin channels as trusted inherit the same exposure even if NightEagle itself is not present.
3 sources · Sep 18
Timeline Sources Sep 18 The Record from Recorded Future
Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Over the past year, Russian cybersecurity firm Kaspersky said it investigated several incidents involving the group at Russian businesses.
original Sep 16 The Hacker News
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky reports three threat clusters targeting Russian enterprises with backdoors, ransomware, wipers, and compromised VPN credentials.
original Sep 16 Kaspersky Securelist
NightEagle APT targets Russian organizations
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub.
original Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-09-16
Every edition of this story: NightEagle reuses credentials and GitHub tooling
More from today