{"id":2902,"date":"2026-09-16T17:34:55","date_gmt":"2026-09-16T17:34:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2902"},"modified":"2026-09-16T17:34:55","modified_gmt":"2026-09-16T17:34:55","slug":"three-threat-groups-target-russian-enterprises-with-backdoors-ransomware-and-wipers","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2902","title":{"rendered":"Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers"},"content":{"rendered":"
\n
<\/a><\/div>\n

Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle<\/strong>, Hacking Cat<\/strong>, and Toy Ghouls<\/strong>, according to multiple reports from Kaspersky.<\/p>\n

The cybersecurity vendor said it has identified attacks<\/a> mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for persistence and lateral movement.<\/p>\n

\u00abIn most incidents, the attackers used compromised valid credentials to gain access to corporate VPNs,\u00bb Kaspersky said in an analysis published today. \u00abVPN connections originated from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from IP addresses associated with European virtual infrastructure providers.\u00bb<\/p>\n

The attacks, as highlighted in July 2025, involve the deployment of GhostContainer, a known modular backdoor that grants the operators complete access to a victim’s Microsoft Exchange Server, as well as run arbitrary code, perform file operations, and load additional modules.<\/p>\n

To sidestep detection, the malware masquerades as a common server component to blend in with regular operations. It can also function as a traffic redirection or tunnel. Prior attacks involving the malware have targeted a government agency and a high-tech company located in Asia.<\/p>\n

\u00abIt incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for the CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility,\u00bb Kaspersky explained. \u00abAll of these components are publicly available on GitHub.\u00bb<\/p>\n

The exact method used by the attackers to deliver GhostContainer to Microsoft Exchange servers is unknown, although it’s believed to have involved the extraction of cryptographic keys used by the server from the ASP.NET configuration, followed by overwriting the VIEWSTATE framework parameter, and injecting a payload into it, causing the backdoor to be launched in memory.<\/p>\n

To move laterally within the internal network, NightEagle has been observed downloading tunneling tools to redirect network traffic via RDP using Microsoft dev tunnels<\/a> and an open-source program called rdp2tcp<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abTo obtain elevated privileges and move laterally through the network, NightEagle exploited various vulnerabilities in Active Directory,\u00bb Kaspersky added. \u00abThe attackers used previously established tunnels to connect to internal infrastructure systems.\u00bb<\/p>\n

<\/p>\n

This includes the exploitation of CVE-2019-0708<\/a> (aka BlueKeep<\/a>) to create a local account on the system and add it to the Administrators and Remote Desktop Users groups. Furthermore, the attackers have attempted to impersonate the domain controller by means of a DCSync attack<\/a>.<\/p>\n

The end goal is to establish persistence in the victim infrastructure, get password hashes for domain accounts, use long-lived Kerberos tickets to gain legitimate access to target resources, and ultimately break into domain controllers and the victim’s entire Active Directory infrastructure.<\/p>\n

Pro-Ukrainian Hacking Cat Deploys Gorilla RAT and Monkey Ransomware<\/h3>\n

The second group to single out Russian enterprises is Hacking Cat, a pro-Ukrainian hacktivist entity with a history of conducting website defacements and data breaches since February 2024. In recent months, however, the group is said to have shifted tactics and pivoted to encryption and destructive attacks.<\/p>\n

\u00abHacking Cat actively collaborates with other hacktivists such as Cyber Anarchy Squad and the Ukrainian Cyber Alliance, which can complicate the attribution of tools to specific attackers,\u00bb Kaspersky said<\/a>.<\/p>\n

Attacks mounted by the group have weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855<\/a> and CVE-2026-42897<\/a>) to deliver a Go-based remote access trojan dubbed Gorilla RAT, which can tunnel traffic to allow the operator to access the victim’s internal network.<\/p>\n

Once launched, the malware establishes a connection with a remote server, registers the victim, and awaits further instructions that allow it to run arbitrary commands, enumerate processes, gather system information, upload\/download files, and open or close a TCP tunnel.<\/p>\n

Also delivered by the threat actor are multiple variants of a ransomware family dubbed Monkey that are written in Rust, .NET, C++, and Golang to target Windows, Linux, and VMware ESXi systems. The earliest Monkey ransomware artifact dates back to late summer 2025. The malware also takes steps to terminate unnecessary processes and inhibit system recovery before starting the encryption process.<\/p>\n

\u00abA Rust-based variant of Monkey Ransomware generates a 32-byte key and encrypts the victim’s files using ChaCha20-Poly1305,\u00bb Kaspersky said. \u00abSome variants do not store the key anywhere, which effectively turns them into full-fledged wiper malware, yet they still leave a ransom note. Other variants, on the other hand, store the key but do not include any contact information in the note.\u00bb<\/p>\n

Some of the notable features spread across the other three variants are listed below –<\/p>\n