NightEagle APT Expands Operations to Target Russian Companies Using GhostContainer Backdoor
The NightEagle APT group, previously focused on Asia, has shifted its operations to target Russian organizations, employing sophisticated techniques including the GhostContainer backdoor and novel tunneling methods.
The NightEagle advanced persistent threat (APT) group, also tracked as APT-Q-95, has expanded its cyber operations beyond its historical focus on Asian targets to include businesses within Russia. Active since at least 2023, the group's recent campaign, investigated by Kaspersky's Global Emergency Response Team (GERT), reveals a refined toolkit and methodology.
Initial access into victim networks is primarily achieved through the exploitation of compromised, valid credentials. Attackers have been observed originating VPN connections from IP addresses associated with Cloudflare WARP tunnels within the Russian segment, as well as from European virtual infrastructure providers. This approach allows for a degree of obfuscation, making it harder to pinpoint the true origin of the intrusion.
A central component of NightEagle's arsenal is the GhostContainer backdoor, which has been deployed on Microsoft Exchange servers. This backdoor is a complex piece of malware that integrates components from several publicly available open-source projects. Notably, it incorporates elements from the Neo-reGeorg tunnel, an exploit for the well-known CVE-2020-0688 vulnerability, and the GhostWebShell class from the ysoserial utility. While the exact delivery mechanism to Exchange servers remains undetermined, researchers suspect the attackers leverage techniques to extract cryptographic keys from ASP.NET configurations, overwrite the VIEWSTATE parameter, and inject the backdoor payload directly into memory.
The GhostContainer backdoor itself is a .NET assembly designed to evade detection. It features three core classes: 'Stub' for processing command-and-control (C2) communications via specific HTTP headers and evading AMSI and Windows Event Log monitoring by overwriting addresses in critical system DLLs like amsi.dll and ntdll.dll; 'App_Web_843e75cf5b63' for managing virtual path redirection; and 'App_Web_8c9b251fb5b3' which handles the proxying and socket forwarding functionalities. Kaspersky products detect this backdoor as Trojan.MSIL.GhostContainer.gen.
Once initial access and privilege escalation are achieved, NightEagle employs Remote Desktop Protocol (RDP) for lateral movement within the compromised network. To facilitate this, the attackers utilize a combination of legitimate services and publicly available tools for traffic tunneling. They host their tools on GitHub repositories, often disguised with legitimate-sounding names. Two key tools identified are Microsoft Dev Tunnels, a legitimate service for publishing local web services, which attackers use to expose RDP ports (3389) to the internet, and rdp2tcp, a tool that tunnels TCP traffic over an established RDP connection.
The combination of Microsoft Dev Tunnels and rdp2tcp is particularly insidious, as it allows attackers to maintain persistent network access and RDP connectivity without opening additional, suspicious ports on the network perimeter. This stealthy approach is further augmented by the use of the atexec utility from the Impacket toolkit to create scheduled tasks for network port forwarding using standard Windows functionality, such as netsh interface portproxy.
For lateral movement and privilege escalation, NightEagle has been observed exploiting various vulnerabilities within Active Directory environments. In one documented incident, the attackers leveraged the BlueKeep vulnerability (CVE-2019-0708) to create a local administrator account on a target system. They have also been seen requesting Kerberos tickets with non-standard flags and attempting DCSync attacks to impersonate domain controllers, indicating a deep understanding of Windows network authentication mechanisms.
This expansion of NightEagle's operations into Russia, coupled with their sophisticated use of backdoors, legitimate tunneling services, and known exploits, highlights the evolving threat landscape. The group's ability to adapt its tactics, techniques, and procedures (TTPs) to target new regions and leverage a mix of custom and open-source tools presents a significant challenge for defenders.