Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia

1. Executive summary

Kaspersky reports that the cyberespionage group tracked as NightEagle (also APT-Q-95), active since at least 2023 and previously focused on strategically sensitive sectors in China including defence, semiconductors, AI and quantum technology, has expanded its operations to Russian companies over the past year. Initial access in most observed incidents came through VPNs using stolen credentials, followed by targeting of Microsoft Exchange servers to deploy a backdoor called GhostContainer, which enables remote control, evasion of some Windows security and logging mechanisms, and network traffic redirection. The group then exploited Active Directory weaknesses for privilege escalation and lateral movement, ultimately attempting to compromise domain controllers. Attribution is unconfirmed: NightEagle has no MITRE ATT&CK profile in our verified reference data, and Chinese researchers' association of the group with North America has not been independently confirmed. No CVE, CVSS score or CISA-KEV exploitation state is recorded for this activity in the verified reference data, and the July 2025 QiAnXin reporting described the Exchange-targeting vector only as what researchers believed could be a previously unknown vulnerability. Direct risk to EMEA financial services is low at present but the tradecraft, credential abuse against VPNs and Active Directory escalation, is sector-agnostic.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The activity is espionage research reporting against Chinese and Russian targets with no confirmed incident at an EMEA financial entity, no named third-party provider compromise, and no vulnerability with a verified identifier or fix. Generic incident-management and reporting duties exist regardless of this advisory and are not triggered by a fact distinctive to it.

3. Technical analysis & attack chain

Confirmed steps, as described by Kaspersky and reported by Recorded Future News:

1. Credential theft. The attackers obtained stolen credentials before the observed intrusions; the source does not describe how the credentials were harvested.
2. VPN initial access. In most investigated incidents, the stolen credentials were used to access corporate networks through VPNs.
3. Exchange targeting and GhostContainer deployment. Once inside, NightEagle targeted Microsoft Exchange email servers and installed the GhostContainer backdoor. Kaspersky could not determine exactly how the backdoor was initially planted on the Exchange servers.
4. In-memory execution (assessed, not confirmed). Kaspersky believes the attackers used a previously observed technique: extracting encryption keys from Exchange and manipulating Microsoft's web application framework to execute the backdoor directly in server memory. This is the researchers' assessment of the likely mechanism, not a confirmed observation in these incidents.
5. Active Directory escalation and lateral movement. The group exploited weaknesses in Active Directory to obtain greater privileges and move between systems, maintaining access, stealing credentials and impersonating legitimate users.
6. Domain controller targeting. The attackers ultimately attempted to compromise domain controllers.

GhostContainer capabilities, per Kaspersky: remote control of compromised servers, evasion of some Windows security and logging mechanisms, and network traffic redirection. The source does not specify which security or logging mechanisms are evaded.

Tool distribution: the group used GitHub to store archives of hacking tools, disguising repositories and files with names resembling legitimate software, specifically AdobeSync and TrueConf. The source does not give repository URLs or file hashes.

Scope and motivation: Kaspersky did not identify the Russian companies targeted, did not disclose the number of organisations affected, and did not specify the likely motivation. QiAnXin's July 2025 reporting characterised the group's activity in China as cyberespionage against defence, semiconductor, AI and quantum technology organisations, and described the Exchange-targeting vector as what researchers at the time believed could be a previously unknown vulnerability. No CVE identifier has been confirmed for that vector.

Attribution caveat: NightEagle has no MITRE ATT&CK profile in our verified reference data, so attribution is unconfirmed. Chinese researchers have associated the group with North America; Recorded Future News states those claims have not been independently confirmed by other researchers. The group's naming derives from operators typically working during nighttime hours in China and frequently changing infrastructure.

Sourcing caveat: the technical detail above rests on a single vendor, Kaspersky, relayed through one press report. The historical China targeting rests on QiAnXin's July 2025 research, also single-sourced. Verify before enforcement.

4. Mitigation & containment

P1, within 24 hours:

• Enforce phishing-resistant MFA on all VPN endpoints and review VPN authentication logs for the past 90 days for logins using valid credentials from unusual geographies, devices or ASNs. Stolen-credential VPN access is the confirmed initial access vector.
• Review Exchange server process behaviour for in-memory web-shell style execution: unexpected w3wp.exe child processes, suspicious .NET assembly loading, or worker processes making outbound connections. Kaspersky assesses GhostContainer executes in memory via manipulation of Microsoft's web application framework, so file-based scanning alone will not find it.
• Check domain controllers for unauthorised privileged account creation, unusual Kerberos ticket activity, and new delegation or replication changes. Domain controller compromise is the group's stated end goal.

P2, within 72 hours:

• Audit Active Directory for the weaknesses this tradecraft exploits: excessive privileged group membership, stale service accounts with unconstrained delegation, ACL misconfigurations allowing DCSync, and accounts with cleartext or weak credentials. The source does not name the specific AD weaknesses, so treat this as a general AD hygiene review against the observed escalation behaviour.
• Hunt for GitHub-based tool retrieval: monitor egress to github.com from server subnets, particularly archive downloads, and block or alert on any repository or file named AdobeSync or TrueConf that is not from the legitimate vendors' official distribution.
• Review Exchange server logging coverage. GhostContainer evades some Windows security and logging mechanisms, so confirm that Exchange IIS logs, PowerShell script block logging and Sysmon event IDs 1, 3, 7 and 10 are forwarded to a tamper-resistant sink.

P3, within 7 days:

• Rotate credentials for all accounts with VPN, Exchange administrative or domain admin privileges, on the assumption that credential theft is part of the group's ongoing access maintenance.
• Restrict management access to Exchange servers to a dedicated administrative tier with no internet egress except approved destinations, reducing the value of both the in-memory backdoor and the GitHub tool staging.
• Validate that VPN session recording or at minimum full authentication telemetry is retained for at least 12 months, given the group's activity window runs back to at least 2023.

No vendor fix is identified in the source material; there is no patch to apply. The July 2025 QiAnXin reference to a possible previously unknown Exchange vulnerability remains unconfirmed and unassigned.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, URLs or file paths. The only machine-adjacent strings are the tool disguise names AdobeSync and TrueConf, which are legitimate product names and are not usable as atomic indicators; alerting on them generically would generate false positives against the real vendors' software.

Behavioural indicators:

6. Detection

Insufficient indicators to author detection rules. The sources contain no hashes, no file paths, no registry keys, no command-line strings, no mutexes and no network indicators. The strings AdobeSync and TrueConf are legitimate product names used as disguises, not artefacts of the threat itself, and a rule matching them would fire on the genuine vendors' software. The behavioural indicators in §5 are the usable detection material; implement them as correlation logic in your SIEM rather than as atomic rules.

7. Sources

• Recorded Future News, "Hacking group 'NightEagle' targeting China's high-tech sector expands operations to Russia", https://therecord.media/hacking-group-nighteagle-expands-russia-china, 18 September 2026
• Kaspersky research on NightEagle incidents at Russian businesses, as reported in the above article, September 2026 (primary technical source, not directly consulted)
• QiAnXin research on APT-Q-95, July 2025, as reported in the above article (primary source on China targeting, not directly consulted)

8. Adverse Trace position

We assess the threat to EMEA financial services clients as low in the near term: confirmed targeting is limited to Chinese and Russian organisations in technology and defence-adjacent sectors, motivation is undetermined, and the technical detail is single-sourced through Kaspersky. Attribution is unconfirmed, and we will not treat the North America association as established. The tradecraft is the transferable risk: stolen-credential VPN access, in-memory Exchange implants that evade logging, AD escalation to domain controllers, and public-code-platform tool staging are all directly applicable to financial sector environments, and clients with internet-facing VPNs and Exchange infrastructure should treat the P1 items as a general hardening check regardless of this group's targeting. We will monitor for the Kaspersky and QiAnXin primary reports, for any CVE assignment against the Exchange vector, and for the first confirmed NightEagle activity outside China and Russia, and we will reissue this advisory if indicators or a confirmed vulnerability identifier emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.