Russian enterprises have been targeted by three distinct cyber threat activity clusters known as NightEagle, Hacking Cat, and Toy Ghouls, according to recent threat intelligence reports.
The groups have used a range of techniques, including compromised credentials, vulnerable Microsoft Exchange servers, remote-access tools, ransomware, wipers, and custom-built backdoors. Their activities demonstrate how attackers continue to combine legitimate administrative tools with custom malware to maintain access and move through corporate networks.
NightEagle Uses Compromised Credentials and Exchange Backdoors
NightEagle, also known as APT-Q-95, has reportedly been active since at least 2023. Recent attacks attributed to the group involve new techniques designed to maintain persistence and facilitate lateral movement across compromised environments.
In many incidents, attackers reportedly gained initial access by using compromised legitimate credentials to connect to corporate VPN infrastructure. Connections originated from Russian IP addresses associated with Cloudflare WARP tunnels, as well as infrastructure operated by European virtual private server providers.
Once inside a network, the attackers deployed a modular backdoor known as GhostContainer.
GhostContainer provides extensive access to Microsoft Exchange servers. Its capabilities reportedly include executing arbitrary commands, performing file operations, loading additional modules, and redirecting network traffic through tunneling functionality.
The malware attempts to avoid detection by masquerading as a legitimate server component and blending into normal system activity.
Previous incidents involving GhostContainer reportedly affected organizations in Asia, including a government agency and a technology company.
GhostContainer Combines Multiple Open-Source Components
Security researchers found that GhostContainer incorporates code and functionality from several publicly available projects.
These components include the Neo-reGeorg tunneling tool, an exploit targeting the CVE-2020-0688 vulnerability, and the GhostWebShell class associated with the ysoserial utility.
The precise delivery mechanism used to install GhostContainer on Microsoft Exchange servers remains unclear. Researchers believe the attackers may have extracted cryptographic keys from ASP.NET configuration files before modifying the VIEWSTATE parameter and injecting a payload that launches the backdoor directly in memory.
NightEagle Targets Active Directory
NightEagle has also been observed using tunneling tools to move through internal networks. The attackers reportedly redirected traffic through Remote Desktop Protocol (RDP) using Microsoft dev tunnels and the open-source rdp2tcp utility.
Researchers also observed attempts to exploit vulnerabilities in Active Directory to obtain elevated privileges and access additional systems.
One technique involved exploiting CVE-2019-0708, commonly known as BlueKeep, to create a local account and add it to the Administrators and Remote Desktop Users groups.
The group has also reportedly attempted DCSync attacks, a technique that can allow attackers to impersonate a domain controller and obtain password hashes for domain accounts.
The broader objective appears to be maintaining long-term access, obtaining credentials, abusing Kerberos authentication, and eventually compromising domain controllers and the wider Active Directory environment.
Hacking Cat Expands From Hacktivism to Ransomware
Another group targeting Russian organizations is Hacking Cat, a pro-Ukrainian hacktivist group that has reportedly conducted website defacements and data breaches since early 2024.
More recently, the group has been associated with encryption and destructive attacks.
Hacking Cat has reportedly worked alongside other hacktivist groups, including Cyber Anarchy Squad and the Ukrainian Cyber Alliance. This collaboration can make it difficult for researchers to determine which group is responsible for individual tools or attack campaigns.
Gorilla RAT Used Against Exchange Servers
In reported attacks, Hacking Cat exploited vulnerabilities in Microsoft Exchange servers, including CVE-2021-26855 and CVE-2026-42897, to deploy a Go-based remote-access trojan known as Gorilla RAT.
The malware can establish a tunnel that gives attackers access to systems within the victim’s internal network.
After execution, Gorilla RAT connects to a remote server and registers the compromised machine. It can then receive commands to execute arbitrary instructions, enumerate running processes, collect system information, transfer files, and establish or terminate TCP tunnels.
Monkey Ransomware Targets Multiple Platforms
Hacking Cat has also been associated with several variants of Monkey ransomware.
The ransomware family includes versions written in Rust, .NET, C++, and Golang, allowing it to target Windows, Linux, and VMware ESXi environments.
The earliest known Monkey ransomware sample reportedly dates back to the latter part of summer 2025.
Before encrypting files, the malware can terminate processes and interfere with system recovery mechanisms.
The Rust-based version generates a 32-byte encryption key and uses ChaCha20-Poly1305 to encrypt files. Some versions reportedly do not save the encryption key, potentially turning the malware into a destructive wiper despite displaying a ransom note.
Other versions store the key but reportedly provide no contact information for victims.
Different Monkey Variants Use Different Techniques
The .NET version generates a 32-byte key, sends it to a command-and-control server, and uses AES-256-CBC to encrypt files.
It can also attempt to elevate privileges, disable Windows recovery features, steal Microsoft Outlook credentials, delete backup-related files, and remove itself after execution.
The C++ version contains several additional capabilities, including:
- Establishing persistence through scheduled tasks or RunOnce registry entries
- Clearing system logs
- Disabling logging mechanisms
- Removing PowerShell command history
- Clearing Windows Command Prompt history
- Attempting to bypass AMSI
- Disabling Event Tracing for Windows
- Adding exclusions for the encryptor
- Modifying Registry settings
- Disabling Task Manager and Command Prompt
- Identifying the victim’s public IP address
- Disabling backup and recovery mechanisms, including Volume Shadow Copy Service
The Golang version primarily targets Linux and VMware ESXi systems. It can establish persistence using crontab entries, disable security mechanisms such as SELinux and AppArmor, and attempt to remove volume shadow copies.
Researchers noted that some functionality appears unnecessary for Linux and ESXi environments, raising the possibility that portions of the toolkit were developed or adapted without platform-specific testing.
Hacking Cat Linked to Additional Destructive Malware
Hacking Cat has also reportedly collaborated with Cyber Anarchy Squad to distribute another ransomware family known as ClearWater through a batch script.
ClearWater is believed to operate under a ransomware-as-a-service model and has reportedly been made available to pro-Ukrainian hacktivist groups.
In a separate operation involving the Ukrainian Cyber Alliance, attackers reportedly deployed a destructive malware family called Nemo Wiper.
Nemo Wiper overwrites files with random data and can consume remaining free disk space by creating files containing random alphanumeric names and a .lock extension.
The reuse of similar tools across different hacktivist operations has made attribution increasingly difficult. Researchers suggested that the malware may originate from a common developer or a small development team whose tools are subsequently used and modified by multiple groups.
Hacking Cat has disputed some of these conclusions, claiming that while some of the identified tools belong to the group, certain ransomware components do not.
Toy Ghouls Introduces a Custom Backdoor
The third threat cluster, Toy Ghouls, is also known by the names Bearlyfy, Laboo.boo, and Feral Wolf.
The financially motivated group has reportedly been active since 2025. Its activities have evolved from the use of leaked Babuk and LockBit ransomware builders to its own GenieLocker ransomware and, more recently, a custom backdoor.
The new backdoor, first detected in July 2026, has been identified in two variants:
- mqtt-bird-agent 0.1.0 — uses the HiveMQ MQTT broker for command-and-control communications.
- matrix-bird-agent 0.1.0 — uses Element, a Matrix-based encrypted messaging application, for command-and-control communications.
Bird Agent Uses WinRM for Deployment
Attackers reportedly use Windows Remote Management (WinRM) to deliver the backdoor and its configuration files to compromised systems.
Open-source utilities such as Evil-WinRM and WinRM-fs are used to facilitate the deployment process.
Bird Agent can operate inside an interactive command-line session or establish persistence as a Windows service.
After launching, the malware searches for a configuration file named config.toml in its current directory. Attackers can also specify the configuration file’s location using the -c or --config command-line options.
The malware partially encrypts the configuration file using a key derived from the victim’s Windows MachineGuid value. This binds the configuration to a particular machine.
If the malware cannot decrypt the configuration during a later execution, it stops running.
Custom C2 Channels Make Detection More Difficult
Depending on the version, the configuration contains either a HiveMQ cluster identifier or an Element room identifier and access token.
After establishing communication, Bird Agent collects system information and retrieves commands from its command-and-control infrastructure.
The HiveMQ version uses HTTP GET requests to obtain commands and executes them through PowerShell in hidden mode. Results are then transmitted back to the attackers.
The Element version performs similar functions but executes received commands through the Windows command-line interface and returns the output to the command-and-control server.
Using MQTT infrastructure and Matrix-based communications gives the malware unconventional channels for command-and-control traffic.
The development of custom tools instead of relying exclusively on publicly available malware and utilities may indicate an effort to improve operational security, evade detection, and maintain access to compromised organizations for longer periods.
Three Different Groups, Similar Objectives
The campaigns associated with NightEagle, Hacking Cat, and Toy Ghouls demonstrate several recurring trends in modern enterprise attacks.
Attackers are increasingly combining legitimate credentials and administrative protocols with custom malware and publicly available tools. Microsoft Exchange, Active Directory, Remote Desktop, WinRM, and other enterprise technologies can become important components of an attack once an adversary gains an initial foothold.
The campaigns also show a growing overlap between espionage-style intrusion techniques, hacktivism, ransomware operations, and destructive attacks.
For organizations, the activity highlights the importance of protecting privileged credentials, promptly patching internet-facing services, monitoring unusual VPN and remote-administration activity, restricting lateral movement, and maintaining reliable offline backups.
Security teams should also monitor unexpected use of tunneling utilities, suspicious Exchange activity, abnormal Active Directory authentication, unauthorized WinRM connections, and newly created administrative accounts.
