Russian Enterprises Target of Three Distinct Threat Clusters Deploying Custom Backdoors and Ransomware

Russian enterprises and corporate networks have increasingly become the primary focus of three distinct cyber threat activity clusters tracked by cybersecurity researchers as NightEagle, Hacking Cat, and Toy Ghouls. According to comprehensive technical reports released by Kaspersky, these threat groups—spanning advanced persistent threat (APT) actors, politically motivated hacktivists, and financially driven cybercriminals—have heavily intensified their campaigns against Russian organizations by adopting sophisticated persistence techniques, custom-built malware, and novel command-and-control communication channels.

The cybersecurity vendor reported that it has closely monitored attacks mounted by the NightEagle threat actor, also known as APT-Q-95. Active since at least 2023, NightEagle has significantly evolved its operational methodologies, integrating advanced techniques for maintaining persistence and executing lateral movement within compromised corporate environments.

In the majority of investigated security incidents, the threat actors successfully leveraged compromised valid credentials to secure unauthorized access to corporate virtual private networks. Kaspersky noted that these malicious VPN connections typically originated from IP addresses located within the Russian segment that were linked to Cloudflare WARP tunnels, as well as from various IP addresses associated with European virtual infrastructure providers.

The sophisticated attack chains deployed by NightEagle heavily rely on the utilization of GhostContainer, a modular backdoor that grants operators comprehensive, unrestricted access to a victim’s Microsoft Exchange Server. This malicious framework allows attackers to execute arbitrary code, perform complex file operations, and dynamically load additional functional modules. To effectively bypass standard security detections and blend seamlessly with routine server operations, the malware cleverly masquerades as an ordinary server component. Furthermore, it possesses the capability to function as a traffic redirection mechanism or a tunneling proxy. Previous iterations of attacks involving GhostContainer have similarly targeted high-profile entities, including government agencies and high-tech enterprises located in Asia.

Technical analysis reveals that GhostContainer incorporates functional components derived from several publicly available open-source projects hosted on GitHub. These include the Neo-reGeorg tunneling tool, an exploit designed for the CVE-2020-0688 vulnerability, and the GhostWebShell class originating from the ysoserial utility.

While the precise vector utilized by NightEagle to initially deliver GhostContainer to target Microsoft Exchange servers remains unconfirmed, security researchers believe the infection process involves extracting sensitive cryptographic keys utilized by the server directly from the ASP.NET configuration. Subsequently, the attackers overwrite the VIEWSTATE framework parameter and inject a malicious payload into it, successfully triggering the backdoor to launch directly in system memory.

To effectively maneuver laterally throughout the internal network infrastructure, NightEagle has been observed downloading specialized tunneling tools designed to redirect network traffic via Remote Desktop Protocol (RDP). These operations utilize Microsoft developer tunnels alongside an open-source utility known as rdp2tcp.

To achieve elevated privileges and traverse internal networks, NightEagle exploits various vulnerabilities inherent to Microsoft Active Directory. The operators utilize their previously established network tunnels to connect directly to internal infrastructure systems. This phase of the attack includes exploiting CVE-2019-0708, widely recognized as the BlueKeep vulnerability, to establish an unauthorized local account and subsequently elevate its privileges by adding it to the Administrators and Remote Desktop Users groups. Additionally, the attackers have attempted to impersonate the primary domain controller by executing a DCSync attack.

The ultimate strategic objective of NightEagle centers on embedding deep persistence within the victim’s IT infrastructure, harvesting sensitive password hashes belonging to domain accounts, utilizing long-lived Kerberos tickets to secure legitimate-seeming access to target resources, and ultimately compromising domain controllers to seize complete control over the entire Active Directory infrastructure.

Pro-Ukrainian Hacking Cat Deploys Gorilla RAT and Monkey Ransomware

Concurrently, Russian enterprises have found themselves in the crosshairs of a second prominent entity known as Hacking Cat. Identified as a pro-Ukrainian hacktivist collective, the group has a documented history of conducting high-profile website defacements and data breaches dating back to February 2024. Over recent months, however, the group has noticeably pivoted its operational tactics toward data encryption and destructive, disruptive attacks.

Kaspersky noted that Hacking Cat actively collaborates with other ideologically aligned hacktivist factions, such as the Cyber Anarchy Squad and the Ukrainian Cyber Alliance. This cooperative ecosystem frequently complicates the definitive attribution of specific tools and malware families to individual threat actors.

Attacks orchestrated by Hacking Cat have frequently weaponized vulnerabilities residing within Microsoft Exchange servers, specifically citing CVE-2021-26855 and CVE-2026-42897, to deliver a Go-based remote access trojan named Gorilla RAT. This malware establishes robust traffic tunneling capabilities, granting the human operator seamless access to the victim organization’s internal network.

Once successfully initiated, Gorilla RAT establishes an outbound connection to a remote server, registers the newly infected victim machine, and awaits incoming instructions from the operators. This command capability enables the malware to execute arbitrary operating system commands, enumerate active processes, harvest detailed system telemetry, upload and download files, and open or close TCP tunnels at will.

Furthermore, the threat actor has distributed multiple variants of a custom ransomware family designated as Monkey. Written across various programming languages including Rust, .NET, C++, and Golang, these ransomware strains are engineered to target Windows, Linux, and VMware ESXi environments alike. The earliest artifacts associated with the Monkey ransomware family date back to the late summer of 2025. Before initiating the file encryption process, the malware systematically terminates non-essential processes and actively inhibits system recovery mechanisms.

A Rust-based iteration of the Monkey ransomware generates a unique 32-byte cryptographic key to encrypt victim files utilizing the ChaCha20-Poly1305 algorithm. Certain variants of the malware omit key storage entirely, effectively transforming the ransomware into a destructive wiper while still leaving a standard ransom note behind. Conversely, other variants securely store the encryption key but intentionally exclude any contact or payment instructions within the note.

Security researchers have also noted potential artifacts indicating careless development practices, such as a Golang variant that incorporates functionality designed to delete shadow volume copies—an action that serves no operational purpose within Linux and ESXi environments. Researchers theorize this oversight suggests the developers likely utilized artificial intelligence tools in constructing their operational toolkit.

Hacking Cat has also been observed partnering with the Cyber Anarchy Squad to disseminate a distinct ransomware strain known as ClearWater, typically distributed via simple batch scripts. ClearWater is assessed to be operated under a ransomware-as-a-service model tailored for pro-Ukrainian hacktivist cells. In another joint operation alongside the Ukrainian Cyber Alliance, the threat actor deployed a destructive wiper malware named Nemo Wiper. This tool overwrites critical files with random bytes of data and subsequently clutters remaining free disk space with newly generated files featuring random alphanumeric names and a .lock extension.

Despite the deployment of shared tooling across multiple hacktivist campaigns, which suggests a centralized source or a small core group of developers maintaining and supplying the malware, Hacking Cat publicly disputed aspects of these findings. Following the publication of security analyses, the group posted statements on its Telegram channel claiming ownership of select tools while denying involvement with specific ransomware lockers, asserting that security vendors should improve their technical attribution capabilities.

Toy Ghouls Deploys Custom Backdoor for the First Time

Rounding out the trio of threat activity clusters targeting Russian organizations is Toy Ghouls, also tracked under aliases such as Bearlyfy, Laboo.boo, and Feral Wolf. This financially motivated group, active since 2025, has progressively transitioned its operational tooling away from relying on publicly leaked ransomware builders—such as Babuk and LockBit—toward developing its own custom GenieLocker ransomware, and more recently, deploying a bespoke backdoor framework.

The newly identified backdoor, first detected in active campaigns in July 2026, surfaces in two distinct technical variants. During these targeted campaigns, the attackers utilize Windows Remote Management to deliver the backdoors and their corresponding configuration files to compromised systems, heavily relying on open-source utilities such as Evil-WinRM and WinRM-fs to facilitate the deployment.

The first variant, known as the Bird Agent backdoor, is capable of operating natively within an interactive command-line session while also establishing system persistence as a standard Windows service. Upon execution, the malware searches for a specific configuration file named config.toml located within its working directory. Alternatively, administrators or operators can explicitly specify the full file path by utilizing command-line options during execution.

The malware reads the designated configuration file and partially encrypts its contents utilizing a cryptographic key derived directly from the MachineGuid value stored within the Windows Registry of the compromised machine. This mechanism effectively binds the configuration file exclusively to that specific host system. If the backdoor fails to successfully decrypt the configuration during subsequent executions, it halts operations entirely.

Depending on the specific variant deployed, the configuration file contains either a cluster identifier utilized to communicate with a HiveMQ MQTT broker or an internal Element room identifier alongside the necessary access token required to authenticate and interact with that room. If this communication parameter is left empty, the backdoor is programmed to dynamically prompt the operator for the required token during installation, subsequently storing it securely.

Once network connectivity is successfully established, the backdoor begins transmitting vital system information to the operator. It dispatches periodic HTTP GET requests to the HiveMQ broker to fetch pending commands issued from the command-and-control server, executes them invisibly via PowerShell, and transmits the resulting output back to the operators. The Element-based variant of Bird Agent functions similarly, with the primary operational distinction being that received commands are executed directly through the standard Windows command-line interface rather than PowerShell.

The adoption of unconventional communication channels—such as the HiveMQ MQTT broker and the Matrix-based Element messenger—highlights an intentional tactical shift by Toy Ghouls. Moving away from standard, publicly available open-source frameworks toward bespoke, custom-built tools underscores the group’s ongoing efforts to increase the sophistication of its operations and successfully evade detection by security defenses for extended periods.