NightEagle is entering Russian corporate VPNs with valid stolen credentials
Kaspersky's incident response team says the group, previously seen working against targets in Asia, logged into VPNs from Cloudflare WARP and European hosting addresses, then ran the GhostContainer backdoor in memory on Exchange.
The Watch · Security desk
What happened
- Kaspersky says NightEagle, tracked as APT-Q-95 and active since at least 2023, is now attacking businesses in Russia after previously working against organizations in Asia.
- In most of the incidents the operators signed into corporate VPNs with valid stolen credentials, from Russian-segment addresses tied to Cloudflare WARP tunnels and from European virtual infrastructure providers.
- They deployed the GhostContainer backdoor on Microsoft Exchange servers both at the initial access stage and later as the intrusion progressed.
Why it matters
- What it limits constraint This traffic walks straight through geography-based screening of VPN logins: the WARP egress lands in Russian address space, and European hosting supplies the rest.
- What's now possible capability Pairing dev tunnels with rdp2tcp gives the operators inbound reach over a Microsoft-owned domain and an already-permitted RDP session, so their access survives a block on unknown attacker IPs.
- Who's exposed exposure Any Exchange server whose ASP.NET machine keys have been readable by an intruder stays reachable after credential resets, until those keys are rotated.
- Who has to decide decision Defenders who want a detection here have to start collecting the RdpCoreTS operational channel names, a log most SIEM pipelines leave out by default.
Next story · Security · 14h ago
Exposed credentials let AI agents under test read live Indian systems, CERT-In saysConfirmed8 publishers
Kaspersky's Global Emergency Response Team says it could not determine how the backdoor reached the Exchange servers. It assesses with high confidence that the operators pulled the Exchange cryptographic keys out of the ASP.NET configuration, overwrote the VIEWSTATE parameter, and injected a payload that started GhostContainer in memory [7]. That path turns on possession of the machine keys.
GhostContainer's own code carries an exploit for CVE-2020-0688, along with the Neo-reGeorg tunnel and the GhostWebShell class from ysoserial, all of it public on GitHub [8]. The CVE identifier is from 2020, three years older than the earliest NightEagle activity Kaspersky dates [22]. The assembly has three classes [9]. Stub takes C2 commands in x-owa-urlpostdata headers and overwrites addresses in amsi.dll and ntdll.dll to blind AMSI and the Windows event log [10]. A second class builds virtual paths from fakePath and fakePageName parameters and hands requests to the third [11], which proxies traffic and forwards sockets [12].
The lateral movement leans on services a network team cannot simply block. Microsoft dev tunnels is a Microsoft feature that publishes a local web service on a *.*.devtunnels.ms domain, and the operators used it to expose port 3389 on compromised hosts [17]. On top of that they ran rdp2tcp, a publicly available tool that carries arbitrary TCP inside an established RDP session, with a server component on the target and a client on the attacker side [18]. Kaspersky says the pairing lets them keep network access through legitimate services [19].
Virtual channel opens and closes land as event IDs 132 and 148 in the Microsoft-Windows-RemoteDesktopServices-RdpCoreTS operational log, normally carrying RemoteFX channel names such as XPSRD, cliprdr and Microsoft::Windows::RDS::DisplayControl [20]. Under rdp2tcp those same events show the channel name rdp2tcp, or whatever random alphanumeric string the operator chose [21]. The tool archives came from GitHub repositories dressed as JavaScript mirrors and browser theme packs [15], and the binaries inside used names such as 1cbroker.exe, trueconf.exe and adobe_32.exe [16]. Kaspersky detects the backdoor as Trojan.MSIL.GhostContainer.gen [13].
Kaspersky's earlier reporting put NightEagle, also tracked as APT-Q-95, on organizations in Asia [2]. This campaign is Russian businesses, across several incidents its responders worked in the past year [1]. Every step here runs on what was already in place, with no fresh vulnerability anywhere in the chain. Configuration breaks it: a second factor on the VPN so a stolen password is not sufficient [4], rotated Exchange machine keys, and an alert on RDP virtual channel names that RemoteFX never uses.
What to watch
- Whether Kaspersky or another vendor reports continued NightEagle activity in Asia alongside the Russian incidents.
- A confirmed observation of the VIEWSTATE delivery step, which would move Kaspersky's high-confidence assessment onto evidence.
- Whether Microsoft adds telemetry or tenant controls for devtunnels.ms use, since the RDP exposure depends on it being reachable.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence58
Perspective Coverage
3 publishers- Builder
- Builder 20%
- Operator
- Operator 70%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Kaspersky's Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group over the past year.
- [2]
NightEagle, also tracked as APT-Q-95, has been active since at least 2023 and originally focused on organizations in Asia, as Kaspersky reported previously.
- [3]
Kaspersky has now identified attacks by NightEagle targeting businesses in Russia.
- [4]
In most of the incidents, the attackers used compromised valid credentials to gain access to corporate VPNs.
- [5]
The VPN connections originated from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from IP addresses associated with European virtual infrastructure providers.
- [6]
Both during initial access and as the attack progressed, the attackers deployed the GhostContainer backdoor on Microsoft Exchange servers.
- [7]
Kaspersky was unable to determine the exact method used to deliver the backdoor to Exchange servers, and believes with a high degree of confidence that the attackers extracted the cryptographic keys used by Exchange from the ASP.NET configuration, overwrote the VIEWSTATE framework parameter, and injected a payload into it that launched GhostContainer in memory.
- [8]
GhostContainer incorporates components from several open-source projects, including the Neo-reGeorg tunnel, an exploit for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility; all of these components are publicly available on GitHub.
- [9]
GhostContainer is a .NET assembly containing three classes that implement its core functionality.
- [10]
The Stub class processes C2 commands delivered through x-owa-urlpostdata headers and evades the Antimalware Scan Interface and Windows Event Log by overwriting addresses in amsi.dll and ntdll.dll.
- [11]
The App_Web_843e75cf5b63 class accepts fakePath and fakePageName parameters and creates virtual paths that redirect requests to the App_Web_8c9b251fb5b3 class.
- [12]
The App_Web_8c9b251fb5b3 class implements network traffic redirection (proxying) and socket forwarding.
- [13]
Kaspersky products detect the GhostContainer backdoor as Trojan.MSIL.GhostContainer.gen.
- [14]
Once the attackers gain sufficient privileges, they use RDP to move laterally within the internal network segment, downloading and running tools for tunneling and redirecting network traffic.
- [15]
The attackers hosted their archived tools in GitHub repositories with names disguised to look legitimate, including mirror-js/mirror-js (js-webpack.zip, jsonp-pack.zip) and browserthemes/resourcepack (resource-pack.zip).
- [16]
Files inside the archives were named to mimic known legitimate software: adobe_32.exe, AdobeSync.exe, trueconf.exe, 1cbroker.exe, 1c-office-plugin.exe and trueconf-broker.exe.
- [17]
The attackers used Microsoft dev tunnels, a legitimate Microsoft mechanism that publishes local web services for internet access on *.*.devtunnels.ms domains, to expose port 3389 (RDP) on the compromised system.
- [18]
rdp2tcp is a publicly available tool for tunneling TCP traffic over an established RDP connection, with a server component that runs on the target system and a client component on the attacker's side.
- [19]
Kaspersky says the combination of Microsoft dev tunnels and rdp2tcp allows the attackers to maintain network access by using legitimate services.
- [20]
When RDP virtual channels are opened and closed, events with IDs 132 and 148 are logged in Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational.evtx, containing channel names such as XPSRD, cliprdr and Microsoft::Windows::RDS::DisplayControl used by the RemoteFX module.
- [21]
When rdp2tcp is used, events 132 and 148 contain the channel name rdp2tcp or other random alphanumeric combinations chosen by the attackers.
- [22]
The vulnerability exploited by a component inside GhostContainer carries a 2020 CVE identifier, three years earlier than the 2023 date Kaspersky gives for NightEagle's earliest known activity.
Sources
3 independent publishers whose own reporting we read for this story.
- securelist.comNightEagle targets Russian companies
1 article · September 16, 2026
- thehackernews.comThree Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
2 articles · September 17, 2026
- therecord.mediaHacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
1 article · September 18, 2026
Topics and entities
Topics
- VPN and Remote Access Credential Abuse
- Network tunneling techniques
- Microsoft Exchange Security
Entities
- Microsoft dev tunnels
- Kaspersky
- Microsoft Exchange Server