NightEagle APT‑Q‑95 Deploys GhostContainer Backdoor to Infiltrate Russian Enterprises

Cyber‑security researchers have identified a new wave of intrusions against Russian businesses that can be traced to the NightEagle advanced persistent threat group, catalogued by analysts as APT‑Q‑95. The campaign blends compromised VPN credentials with a covert Microsoft Exchange backdoor and a legitimate tunneling framework known as GhostContainer, allowing attackers to move laterally while evading typical detection mechanisms.

The operation begins with the theft of valid VPN logins, often harvested from previously compromised accounts or purchased on underground markets. Once inside a corporate perimeter, the threat actors install a stealthy backdoor within Microsoft Exchange servers, granting persistent access to email and calendar services. The backdoor is then paired with GhostContainer, a legitimate remote‑access tool that creates encrypted tunnels, masking malicious traffic as routine network traffic.

NightEagle, first observed targeting supply‑chain vendors in Southeast Asia and Europe, has historically favored multi‑stage attacks that combine credential theft with custom malware. The recent shift toward Russian entities marks a notable expansion of its geographic focus, suggesting either a change in strategic objectives or a response to heightened demand for intelligence on the region’s industrial sectors.

Russian firms, particularly those operating in energy, manufacturing, and logistics, are attractive to threat actors because of the critical nature of their services and the potential for espionage or disruption. The use of a legitimate tunneling product complicates attribution and hampers incident response, as security teams must differentiate between authorized administrative traffic and malicious activity.

Local cyber‑defense agencies have issued alerts urging organizations to audit VPN access, enforce multi‑factor authentication, and monitor Exchange servers for anomalous administrative actions. Security vendors recommend deploying behavioral analytics that can flag the characteristic patterns of GhostContainer usage, such as unexpected outbound connections to obscure endpoints.

Analysts warn that the blending of stolen credentials, custom backdoors, and off‑the‑shelf tunneling tools could become a template for other APT groups. As defenders adapt, the cat‑and‑mouse dynamic is likely to intensify, with attackers continuously refining their methods to exploit trusted infrastructure while remaining under the radar.