A cyberespionage group known as NightEagle, or APT-Q-95, has expanded its operations from targeting sensitive technology and defense organizations in China to Russian companies, according to new research from Kaspersky. Active since at least 2023, NightEagle had previously focused its attacks in Asia but has recently been implicated in several incidents involving Russian businesses.
In these attacks, the hackers typically used stolen credentials to access corporate networks via virtual private networks (VPNs). Once inside, they targeted Microsoft Exchange email servers and installed a backdoor known as GhostContainer, which enables remote control of compromised servers while evading certain Windows security measures and redirecting network traffic. Kaspersky noted that the exact method of how GhostContainer was initially deployed remains unclear, although researchers suspect it involved extracting encryption keys from Exchange and manipulating Microsoft’s web application framework.
Additionally, NightEagle utilized GitHub to store archives of hacking tools, disguising them with names resembling legitimate software such as AdobeSync and TrueConf. After establishing a foothold, the group exploited vulnerabilities in Active Directory to gain higher privileges and move laterally within networks, allowing them to maintain access, steal credentials, and impersonate legitimate users. Their ultimate goal appeared to be compromising domain controllers, which are critical for managing access across an organization’s network.
Kaspersky researchers indicated that NightEagle is updating its methods to broaden its target scope, adopting new techniques for persistence and lateral movement. However, the specific Russian companies targeted and the number of affected organizations have not been disclosed, nor has the motivation behind these attacks been clarified.
NightEagle first gained attention in July 2025 when researchers from QiAnXin, a Chinese cybersecurity firm, described their operations. They noted that the group had been active since at least 2023, focusing on organizations in China involved in strategically sensitive sectors, including defense and artificial intelligence. The group was named NightEagle due to its tendency to conduct attacks during nighttime hours in China and its frequent changes in operational infrastructure.
For more details, see the full report by The Record.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
